AI & Technical question

Design the core of Figma’s external platform for agents and developer tools. How should the MCP Server and REST APIs expose file context, permissions, freshness, rate limits, versioning, and observability so partners like Claude or Cursor can build reliably on top of Figma without creating fragility for internal product teams using the same platform?

Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.

What this question tests

Platform design thinking: balancing external developer needs against internal product stability at API scale.

Define the core resources the MCP Server and REST APIs expose: file context, node and component data, permissions, and version state.
Design permissions and scoping so partners like Claude or Cursor only see what the authenticated user is allowed to see.
Address freshness with a clear staleness contract, such as webhooks or ETags, so partners know when cached file context is outdated.
Set rate limits and quota tiers that protect Figma's own product teams from noisy-neighbor partner traffic on shared infrastructure.
Version the API explicitly so partner integrations do not break silently when internal teams ship changes.
Add observability, like per-partner usage dashboards and error budgets, so both sides can see reliability in real time.

Treats internal product teams as just another API consumer, which forces the platform to be robust rather than special-cased.
Proposes a concrete freshness mechanism, for example a version token on file state, instead of a vague sync promise.
Separates the read-heavy MCP context use case from the broader REST API surface, since they need different rate limit strategies.
Names observability as a first-class requirement, not an afterthought, given partners will build production products on this.

Designing the API around one partner's current needs and making it too rigid for future integrations.
Ignoring internal team impact and only optimizing for external developer experience.

How would you version a breaking change without stalling partner development?
What would you do if Cursor and internal teams contend for the same rate limit pool?
How do you decide what permissions granularity is enough?