hubspot v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-hubspot-private-app-token

Custody

customer_vault

Injection

header (Authorization)

A HubSpot private app access token, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the token — 'Bearer <token>'. Token issuance is an external process: a super admin creates the private app in the HubSpot account (Development > Legacy apps > Create legacy app > Private), chooses its scopes, and copies the token from the app's Auth tab; the executor performs no token lifecycle itself and injects the stored value verbatim. Least privilege: HubSpot scopes are per-object and per-operation for most CRM objects (for example crm.objects.contacts.read versus .write), but tickets are the documented exception: HubSpot's scope list documents the ticket-read scope as 'tickets' (which includes access to tickets) — tickets do not follow the crm.objects.<object>.read pattern, and no crm.objects.tickets.read scope exists — so grant crm.objects.contacts.read, crm.objects.companies.read, crm.objects.deals.read and tickets for the reads, plus crm.objects.contacts.write for the create capability — and nothing more. Expiry and revocation: private app access tokens do not expire on their own; rotation is manual from the app's Auth tab — 'Rotate and expire now' invalidates the original token immediately, while 'Rotate and expire later' leaves it valid for 7 days — and deleting the private app permanently revokes its token. Because the token IS the credential (no separate tokens are issued from it), rotation or deletion revokes exactly this value; HubSpot recommends rotating every six months and emails super admins when a token has gone unrotated for 180 days. Renewal ownership sits with an external deployment process. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• hubspot-account-contacts (api, pii): https://api.hubapi.com/crm/v3/objects/contacts
• hubspot-account-companies (api, internal): https://api.hubapi.com/crm/v3/objects/companies
• hubspot-account-deals (api, financial): https://api.hubapi.com/crm/v3/objects/deals
• hubspot-account-tickets (api, pii): https://api.hubapi.com/crm/v3/objects/tickets

Every endpoint here is on api.hubapi.com, the shared HubSpot API host named in HubSpot's own private-app documentation, so there is no per-customer host to substitute; HubSpot responses also reference the api.hubspot.com alias, which this pack deliberately does not allowlist — one authority per capability, exactly as registered. This pack registers only endpoints the official HubSpot developer documentation describes: the CRM v3 objects collection reads for contacts, companies, deals and tickets, and single-record contact creation. All read capabilities cover the COLLECTION read only (GET /crm/v3/objects/{object}): single-record reads (GET /crm/v3/objects/{object}/{recordId}), batch reads, search and association navigation endpoints are not registered by this pack. Documented exclusions: this pack does not register record update or delete (PATCH/DELETE /crm/v3/objects/{object}/{recordId}), batch create/update/archive operations, the standalone association-write endpoints (contact creation can itself establish associations to existing records through the associations object in the same POST — that is part of the registered create capability, and what is excluded is the standalone association-write surface), company, deal or ticket creation, engagements (notes, calls, meetings, tasks), and any email-sending surface (marketing email send, transactional single-send): a send capability would carry the send verb at the R3 floor, and this pack registers none — a documented exclusion, not an approximated capability. Data-class rationale: contacts and tickets identify individuals and carry their messages, so both are registered at the pii class; deals carry amounts, stages and close dates — the account's revenue pipeline — and are registered financial for the same reason the Salesforce pack classes opportunity data financial; companies describe organizations rather than individuals and are registered internal, and a deployment whose company records carry personal or regulated data should raise the class before enabling. Tiering: reads sit at R0 (the read floor) and contact creation at R2 (the create floor); the shipped pack registers at the minimum and policy can raise a tier for a specific actor, scope or resource. The review state is draft, not library: the endpoints are verified against the provider documents named in the review block, but the custody-model review the capability-library plan (docs/gtm/CAPABILITY-LIBRARY-PLAN.md §4) gates on — issuance authority, scope, audience, TTL, revocation, executor access and bypass paths — is unfinished for this pack.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://developers.hubspot.com/docs/api/crm/contacts (retrieved 2026-09-21)
• https://developers.hubspot.com/docs/api/crm/companies (retrieved 2026-09-21)
• https://developers.hubspot.com/docs/api/crm/deals (retrieved 2026-09-21)
• https://developers.hubspot.com/docs/api/crm/tickets (retrieved 2026-09-21)
• https://developers.hubspot.com/docs/api/private-apps (retrieved 2026-09-21)
• https://developers.hubspot.com/docs/api/scopes (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.