Connect Figma to Lutril
Lutril connects to Figma over SCIM 2.0, with a token from your Figma admin settings. Figma's REST API exposes no endpoint for reading or managing the members of an organization, so a personal access token, a plan access token and an OAuth 2 app all stop at the file and activity APIs. SCIM is the whole member surface: it creates an account, deactivates one at a just-in-time deadline, and lists the people it has provisioned. That list is not the organization roster, and Figma offers nothing that is. It works on the Organization plan and the Enterprise plan alike; SCIM is not available on Starter or Professional. One feature differs between the two: assigning a seat type through SCIM is Enterprise only, and on Organization Figma applies its own default seat instead.
Access requested
- A SCIM API token from Admin settings, Login and provisioning, SCIM provisioning. Figma shows it once, at creation. It carries the whole SCIM surface; there are no per-endpoint scopes to select.
- Read: GET /Users returns the users Figma has SCIM-provisioned, which its own reference states plainly: "a list of currently SCIM provisioned users in the organization". It is not the organization roster. On an org that has just turned SCIM on it is empty, and it fills as Lutril provisions people. Figma exposes no endpoint that lists every member, on any plan or token type.
- Provision: POST /Users creates the account. No password is set or generated at any point. A SCIM account on Figma signs in through your organization's SSO. Organization and Enterprise.
- Deprovision: PATCH /Users/:id with op replace, path active, value false. The person leaves the organization and the SCIM record survives, so the next grant re-enables the same account. Organization and Enterprise. Lutril never calls DELETE /Users/:id, which erases the user and its provisioning record: hard deletion stays a human action in the Figma admin console.
- Seat type, Enterprise only: roles of the form { type: seatType, value: Full, Dev, Collab or View }. On an Organization plan, leave the seat unset in Lutril; Figma creates the account on its own default seat and any upgrade is a manual action in the Figma admin console.
Setup steps
- 1
In Figma, open Admin settings, then Access, Authentication, SAML SSO, and copy your Tenant ID. Take it from that screen and nowhere else: it is the SAML org id, not the organization id that appears in a figma.com URL. Both are long numbers, so they are easy to mix up, and Figma answers a wrong one with a bare 404 that names neither.
Open Figma admin settings - 2
Build your SCIM base URL from that tenant id. Figma for Government uses figma-gov.com in place of figma.com.
Texthttps://www.figma.com/scim/v2/YOUR_TENANT_IDThis is what Lutril's SCIM Base URL field expects: no trailing slash, and no /Users suffix. - 3
Open Admin settings, Login and provisioning, SCIM provisioning, and generate an API token. Copy it immediately: Figma shows it only once.
- 4
In Lutril, connect Figma and paste the SCIM Base URL and the token into the SCIM Bearer Token field. The token is encrypted at rest and never written to configuration or logs.
- 5
Optional, on the Enterprise plan, for just-in-time access: in the Lutril catalogue, set the seat type an automatic grant applies, and offer the same four seats as request options. The seat Lutril sends is always the one an owner configured, never the one the requester picked. On an Organization plan leave the seat unset: just-in-time access works the same, and Figma decides the seat.
Where to create it
Official docs
Sign in to Lutril to connect Figma, or book a demo and we set it up with you. No slides.