canonical: https://jentic.com/apis/hubapi.com/hubspot-files

# HubSpot Files

Jentic publishes the only available OpenAPI specification for HubSpot Files, keeping it validated and agent-ready. The HubSpot Files API manages the file manager attached to a HubSpot portal - uploading binary files, importing from URLs, organising them into folders, generating signed URLs for private files, and handling GDPR deletion. Files stored here are referenced by HubSpot CMS pages, marketing emails, and CRM records, so the API is the integration surface whenever an agent or app needs to put assets into the HubSpot ecosystem.

## For AI agents

Upload, search, replace, and delete files in the HubSpot file manager, plus manage folders, signed URLs, and asynchronous URL imports.

## Scope

Does not store CRM contact records, send marketing emails, or manage CMS pages - use only for HubSpot file manager uploads, folders, and signed URLs.

## Capabilities

- Upload a binary file to HubSpot via POST /files/v3/files
- Import a file from a public URL asynchronously through /files/v3/files/import-from-url/async and check its task status
- Search files and folders by name, type, and folder via /files/v3/files/search and /files/v3/folders/search
- Replace a file in place with PUT /files/v3/files/{fileId} so existing references remain valid
- Generate a signed URL for a private file through GET /files/v3/files/{fileId}/signed-url
- Create, update, and delete folders, including async folder property updates
- GDPR-delete a file via DELETE /files/v3/files/{fileId}/gdpr-delete

## Use cases

### Sync Marketing Assets into HubSpot

Upload product images, datasheets, or branded PDFs into the HubSpot file manager so they can be referenced in CMS pages and marketing emails. POST /files/v3/files accepts multipart uploads; /files/v3/files/import-from-url/async pulls assets from existing URLs without proxying through the agent.

Example prompt: POST a PDF datasheet to /files/v3/files with folderPath /marketing/datasheets and confirm a 201 response with the file URL.

### Replace Files Without Breaking References

When a marketing PDF or image needs an updated version, PUT /files/v3/files/{fileId} replaces the binary in place. Existing CMS pages and email links keep working because the file ID and URL stay the same. This is faster and safer than uploading a fresh file and rewriting references.

Example prompt: PUT the new datasheet PDF to /files/v3/files/9876543210 to replace the existing file binary while preserving its public URL.

### GDPR-Compliant File Deletion

Honour data subject deletion requests by calling DELETE /files/v3/files/{fileId}/gdpr-delete, which permanently removes the file and prevents recovery. This is the compliant path versus DELETE /files/v3/files/{fileId}, which is a soft delete only.

Example prompt: DELETE /files/v3/files/{fileId}/gdpr-delete for every file referenced by the deletion-request user record.

### AI Agent File Storage via Jentic

An AI agent that generates a report PDF or image asset uses Jentic to upload it into HubSpot's file manager and then references the returned URL in a marketing email or CMS page - without juggling HubSpot OAuth flows in the agent code.

Example prompt: Search Jentic for upload a file to hubspot, load POST /files/v3/files, and execute with the binary and folderPath /agents/output.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /files/v3/files | Upload a file |
| POST | /files/v3/files/import-from-url/async | Import a file from a URL asynchronously |
| GET | /files/v3/files/search | Search files |
| PUT | /files/v3/files/{fileId} | Replace a file in place |
| GET | /files/v3/files/{fileId}/signed-url | Get a signed URL for a private file |
| DELETE | /files/v3/files/{fileId}/gdpr-delete | GDPR-delete a file permanently |
| POST | /files/v3/folders | Create a folder |
| GET | /files/v3/folders/search | Search folders |

## Key resources

- **Files** — Upload, search, replace, delete, and sign HubSpot files
- **Folders** — Create, update, and delete folders, including async property updates

## Why Jentic

- **Setup:** Wiring HubSpot Files by hand means choosing between its hapikey query, OAuth, and private-app auth, keeping the api.hubapi.com host straight across the files v3 upload, folder, and signed-URL endpoints, and handling errors yourself. Through Jentic you install once, import Files from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** Files puts the file id in the URL path (/files/v3/files/{fileId}/...), so a rule can pin your agent to one file: it can update it or fetch its signed URL and nothing else. You choose the operations it may call, so a destructive operation like the GDPR delete is not included unless you add it.
- **Credential handling:** Your HubSpot credential is stored once, encrypted, by your own Jentic One instance and injected per call at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'upload a file to HubSpot' or 'get a signed URL for a file', and Jentic returns the matching /files/v3 operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **HubSpot CMS API** — Reference uploaded files in HubSpot CMS pages and templates
- **HubSpot Marketing API** — Reference uploaded files (logos, attachments) in marketing emails and assets
- **Filestack API** — General-purpose file upload and transformation service outside the HubSpot ecosystem

## FAQ

### Why is there no official OpenAPI spec for HubSpot Files?

HubSpot does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Files via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the HubSpot Files API use?

Files supports HubSpot hapikey (query), OAuth 2.0 authorization code with the files or files.ui_hidden.read scopes, and private-app legacy tokens (private-app-legacy header). Through Jentic, the configured credential is stored encrypted and injected at call time.

### Can I import a file from a public URL instead of uploading bytes?

Yes. POST to /files/v3/files/import-from-url/async with the source URL; HubSpot fetches the file in the background. Poll /files/v3/files/import-from-url/async/tasks/{taskId}/status to confirm completion.

### What are the rate limits for the HubSpot Files API?

Files inherits HubSpot's standard rate limits - typically 100 requests / 10 seconds for hapikey, higher under OAuth on Enterprise. File size limits depend on plan tier and are enforced at upload time with a 4xx response.

### How do I get a private file URL I can share through Jentic?

Search Jentic for get a signed url for a hubspot file, load GET /files/v3/files/{fileId}/signed-url, and execute with the fileId. Jentic returns the time-limited signed URL the recipient can use without HubSpot credentials.

### What is the difference between DELETE and gdpr-delete?

DELETE /files/v3/files/{fileId} performs a soft delete that can be reversed. DELETE /files/v3/files/{fileId}/gdpr-delete permanently removes the file and is the correct call for data-subject deletion requests.

### Can I limit what my agent is allowed to do with the HubSpot Files API?

Yes. Because you run Jentic One yourself, your own rules decide which HubSpot Files operations your agent may call and which stored credential it uses. Since the file id sits in the URL path (/files/v3/files/{fileId}/...), a rule can pin the agent to a single file so it can only replace that file or fetch its signed URL and nothing else. You choose the operation set too, so a destructive call like DELETE /files/v3/files/{fileId}/gdpr-delete stays out of reach unless you explicitly add it.