figma-rest-api-endpoints — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited figma-rest-api-endpoints (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
I am a reference for the Figma REST API v1. Use me when you need to know which endpoints exist, how they're called, and what tiers/rate limits apply.
https://api.figma.com/v1X-Figma-Token: <token>Authorization: Bearer <token>file_content:read, library_content:read, file_variables:read (Enterprise only)| Method | Endpoint | Tier | Used in | Purpose |
|---|---|---|---|---|
GET | /files/:key | T2 | FigmaService.getRawFile() | Full file data with geometry=paths |
GET | /files/:key/nodes?ids=... | T1 | FigmaService.getRawNode(), fetchNodesBatch() | Specific node data with depth param |
GET | /files/:key/styles | T3 | fetchStyles() | All styles in a file |
GET | /files/:key/components | T3 | fetchComponents(), componentMap.ts | All components in a file |
GET | /files/:key/variables/local | T2 | FigmaService.getLocalVariables(), fetchVariables() | Local variables + collections |
GET | /files/:key/comments | T3 | fetchComments() | Comments on the file |
GET | /files/:key/images | T2 | FigmaService.getImageFillUrls() | Download URLs for image fills |
GET | /images/:key?ids=... | T2 | FigmaService.renderNodeImages() | Render nodes as PNG images |
GET | /components/:key | T3 | componentMap.ts | Resolve component key → library file key |
| Tier | Professional (Dev/Full) | Organization | Enterprise |
|---|---|---|---|
| T1 | 10 req/min | 30 req/min | 50 req/min |
| T2 | 25 req/min | 60 req/min | 200 req/min |
| T3 | 50 req/min | 150 req/min | 500 req/min |
get_figma_designEach invocation makes:
| # | Endpoint | Tier |
|---|---|---|
| 1+ | GET /files/:key/nodes | T1 (1 + N where N = unique library files) |
| 1 | GET /files/:key/variables/local | T2 (if resolveVariables=true) |
| 1 | GET /files/:key/styles | T3 |
| 1 | GET /files/:key/comments | T3 |
| N | GET /components/:key | T3 (resolve component keys) |
| N | GET /files/:libKey/components | T3 (fetch library components) |
All Figma REST API calls should be methods on FigmaService in src/services/figmaConnector.ts. Files that currently bypass this:
src/figma/fetch.ts — fetchStyles(), fetchComponents(), fetchVariables(), fetchComments()src/figma/batchFetch.ts — fetchNodesBatch()src/figma/mcp/componentMap.ts — component resolution + library fetchThese should be migrated to FigmaService methods and callers should use the service instance.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.