Skip to main content

Figma SCIM Admin

Figma SCIM Admin lists Enterprise organization members and can deactivate a member through Figma's SCIM 2.0 API (GET / PATCH /scim/v2/Users on api.figma.com).

This connector is separate from the regular Figma OAuth connector used for files and comments. A design OAuth token cannot call SCIM.

Seat type cannot be changed through the API. userType (Full, Dev, View, and similar) is returned on list/get and is read-only. Deactivating a member removes access; it does not downgrade their seat to a cheaper type.

Authentication Types​

Figma SCIM Admin supports 1 authentication method:

  • SCIM token — sent as Authorization: Bearer. Generated in Figma Admin under login and provisioning.
    • Pros: Matches Figma's IdP provisioning flow
    • Cons: Enterprise plan only; cannot set seat type

Setting up a SCIM token​

  1. Confirm the organization is on a Figma Enterprise plan.
  2. Sign in as an organization admin.
  3. Open Admin → Settings → Login and provisioning (sometimes Authentication).
  4. Enable SCIM if needed, generate a SCIM token, and paste it into Willow. The token is shown once.

See Figma's SCIM API.

Available Tools​

  • List Users — GET /scim/v2/Users. Page with startIndex (1-based) and count (max 100). Optional email filter (userName eq "..."). Returns userName, active, and userType (seat).
  • Get User — GET /scim/v2/Users/{id}.
  • Deactivate User — PATCH /scim/v2/Users/{id} with SCIM PatchOp active=false. The member loses access. Seat type is not modified.

Troubleshooting​

401 or token rejected​

Cause: The secret is a Figma personal access token or OAuth access token, not a SCIM token.

Solution: Generate a SCIM token in Admin → Settings → Login and provisioning.

Seat still billed after deactivate​

Cause: Figma SCIM does not expose an operation to change userType / seat.

Solution: Change the seat in the Figma Admin UI if deactivate is not enough for billing.

On this page