API auth bug: files/:file_key/styles returns 400 "Missing valid token credentials" for a PAT that succeeds on /components and /component_sets

GET /v1/files/:file_key/styles rejects a valid/correctly scoped PAT while the two sibling endpoints - GET /v1/files/:file_key/components andGET /v1/files/:file_key/component_sets - accept the exact same token against the exact same file. This appears to be a regression introduced between 2026-08-07T15:58:51Z and 2026-08-08T07:37:18Z.

The response is:

HTTP/2 400
{"error":true,"status":400,"message":"Missing valid token credentials","i18n":null}

/v1/files/:file_key/styles

2026-08-10T09:11:58Z

b7838db7-0de6-4fae-958b-4bd89457e19c

/v1/files/:file_key/components

2026-08-10T09:11:59Z

f2e913d8-63be-4b3d-9926-d515f10b86ed

/v1/files/:file_key/component_sets

2026-08-10T09:12:00Z

70742e97-1695-4c2f-9237-ed155c896855

The token is valid and correctly scoped. Everything else we call succeeds:

- GET /v1/me → 200
- GET /v1/files/:key?depth=1 → 200
- GET /v1/files/:key (full) → 200
- GET /v1/files/:key/nodes?ids=… → 200
- GET /v1/files/:key/meta → 200, reports role: owner
- GET /v1/styles/:key → 200 for individual published styles in this same file
 

It used to work with this same token. Our committed baseline snapshot was generated from this endpoint on 2026-08-06 at 16:01 UTC+1 and captured 27 styles. The first failure we observed was 2026-08-08 at 07:37 UTC+1. Nothing changed on our side in between - no token rotation, no code change to the call. We found no entry in the REST API changelog for that window.

Reproduction Steps

This is 100% reproducible with the above information. Something has changed Figma side.

1. Create a personal access token, ticking every scope offered in the UI.
2. Run, substituting the token:

FILE=...
for ep in styles components component_sets; do
  printf '%-16s ' "/$ep"
  curl -s -o /dev/null -w 'HTTP %{http_code}\n' \
    -H "X-Figma-Token: $FIGMA_TOKEN" \
    "https://api.figma.com/v1/files/$FILE/$ep"
done

3. Observe:

/styles          HTTP 400/components      HTTP 200/component_sets  HTTP 200

Expected: HTTP 200 from all three, per the identical security blocks in the OpenAPI spec.