canonical: https://jentic.com/apis/penpot.app/penpot

# Penpot App Penpot API

Penpot is an open-source design and prototyping platform that provides a complete API for programmatic access to design files, projects, teams, comments, and media assets. The API enables developers to automate design workflows, build integrations with other tools, manage design systems, and create custom applications on top of Penpot. With 123 endpoints, the API covers file management, collaboration features, team administration, asset handling, and template operations.

## For AI agents

Manage Penpot design files, projects, teams, comments, and assets programmatically.

## Scope

Provides access to penpot.app resources and operations as documented in the OpenAPI specification.

## Capabilities

- Create, read, update, and delete design files and projects
- Manage teams, team members, and permissions
- Handle comments and comment threads on design elements
- Upload and manage media objects and file assets
- Clone files and templates for design system workflows
- Generate access tokens for API authentication
- Export design files in various formats
- Manage webhooks for design event notifications

## Use cases

### Design System Automation

Automate design system workflows by programmatically creating templates, cloning files, and managing design components across projects. Use the file and media endpoints to keep design assets synchronized with code repositories and ensure consistency across teams.

Example prompt: Use clone-template and clone-file-media-object endpoints to replicate design system components across projects, then export them for use in development workflows.

### Design Review Workflow Integration

Build custom design review workflows by integrating Penpot comments and notifications with project management tools. Create comment threads programmatically, track feedback, and notify stakeholders when designs are ready for review.

Example prompt: Use create-comment and create-comment-thread endpoints to add review feedback, then set up webhooks to notify external systems when comments are added or resolved.

### Automated Design Export Pipeline

Create automated pipelines that export Penpot designs in various formats for use in production applications, marketing materials, or documentation. Schedule exports, transform assets, and deliver them to CDNs or asset management systems.

Example prompt: Query design files, trigger exports via the API, and upload resulting assets to a CDN or asset management system as part of a CI/CD pipeline.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `clone-file-media-object` | Clone media objects between files |
| POST | `clone-template` | Clone a template for reuse |
| POST | `create-access-token` | Generate API access token |
| POST | `create-comment` | Add a comment to a design element |
| POST | `create-comment-thread` | Start a new comment thread |

## Key resources

- **Files** — Design files containing pages, frames, shapes, and other design elements
- **Projects** — Containers for organizing related design files
- **Teams** — Organizations with members, roles, and shared resources
- **Comments** — Feedback and discussion threads attached to design elements
- **Media Objects** — Images, fonts, and other assets used in designs
- **Templates** — Reusable design patterns and components
- **Access Tokens** — API authentication credentials

## Why Jentic

- **Setup:** Wiring Penpot by hand means minting an access token through its create-access-token method and calling its command-style endpoints under design.penpot.app yourself. Through Jentic you install once, import the Penpot API from the API Directory, store the access token once, and your agent calls it.
- **Permission scoping:** Penpot exposes command-style operations such as create-comment, duplicate-file, and delete-team rather than resource ids in the URL path, so scoping is operations-only: limit the agent to the operations it needs, such as reading a project or creating a comment, and leave destructive ones like delete-team out of the allowed set unless you add them.
- **Credential handling:** Your Penpot access token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'add a comment to a design file', and Jentic returns the matching Penpot operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## FAQ

### What authentication does the penpot.app API use?

The penpot.app API uses none authentication. Through Jentic, credentials are stored encrypted and injected at execution time so they never enter the agent's context.

### How many endpoints does the penpot.app API have?

The penpot.app API exposes 123 endpoints across its surface area.

### Can I limit what my agent is allowed to do with the Penpot API?

Yes. Because you run Jentic One yourself, your own rules decide which Penpot operations and credentials your agent may use. Penpot exposes command-style operations such as create-comment, duplicate-file, and delete-team rather than resource ids in the URL path, so scoping is operations-only: you allow just the operations the agent needs, like reading a project or adding a comment. Destructive operations such as delete-team stay outside the allowed set unless you explicitly add them.