HubSpot Audit Logs

Name: Audit Logs API
Brand: Audit Logs
Availability: InStock

✓ Official Vendor SpecSecurityComplianceoauth2, apiKey3 EndpointsREST

Install Jentic One Beta

Connect the Audit Logs to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Audit Logs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Audit Logs API.

Retrieve recent successful login activity for users on a HubSpot portal

Pull audit-log entries showing user actions on the portal

Read security-history entries such as password changes and 2FA updates

GET STARTED

Start building with Audit Logs API

Explore with Jentic

View OpenAPI Document

For Agents

Read HubSpot portal login, audit, and security activity for compliance monitoring, SIEM ingestion, and incident investigation.

Use for: I need to retrieve login activity for a HubSpot portal, Get the audit log entries for the last 24 hours, List all security history events for user 12345, Find users who changed their password this week

Not supported: Does not write audit entries, manage users, or modify security settings — use only for reading HubSpot portal login, audit, and security-history activity.

Use Cases

Patterns agents use Audit Logs API for, with concrete tasks.

★ Feed HubSpot activity into a SIEM

A security team that consolidates events in Splunk or another SIEM can poll the three audit endpoints on a schedule and forward each record. GET /account-info/v3/activity/login returns successful logins, GET /account-info/v3/activity/audit-logs returns user-action audit records, and GET /account-info/v3/activity/security returns security events. The endpoints are paginated, so the poller advances through results until it reaches the last seen timestamp.

Call GET /account-info/v3/activity/audit-logs with occurredAfter set to the last sync timestamp, page through results, and forward each entry to the SIEM

Investigate a suspicious user action

When a HubSpot admin sees an unexpected change, an investigator can query GET /account-info/v3/activity/audit-logs filtered by user id to retrieve every action that user took, then cross-reference GET /account-info/v3/activity/security for password or 2FA changes. The combined timeline supports an incident response without leaving the API.

Call GET /account-info/v3/activity/audit-logs with userId=98765 for the last 7 days, then GET /account-info/v3/activity/security for the same user to assemble a timeline

Compliance reporting for SOC 2 evidence

SOC 2 evidence often requires periodic exports of administrative activity. The audit-logs endpoint returns the list of user actions on the portal, the security endpoint surfaces password and 2FA changes, and the login endpoint confirms access patterns. Together they form an evidence pack that can be archived monthly.

Schedule a monthly job that pulls all three endpoints for the previous calendar month and stores the JSON exports in evidence storage

Agent integration via Jentic

A compliance agent can answer 'who logged into HubSpot this morning' by calling the login endpoint through Jentic. The agent searches for the operation, loads the schema, executes with a since timestamp, and summarises the results. The HubSpot credential stays in the Jentic vault.

Search Jentic for 'list hubspot login activity', load GET /account-info/v3/activity/login, and execute with occurredAfter=this morning's ISO timestamp

Key Endpoints

3 endpoints — the hubspot audit logs api returns user-activity records for a hubspot portal — successful logins, audit events, and security-history entries such as password changes and two-factor updates.

METHOD

PATH

DESCRIPTION

GET

/account-info/v3/activity/login

Retrieve login activity for the portal

GET

/account-info/v3/activity/audit-logs

Retrieve audit-log entries

GET

/account-info/v3/activity/security

Retrieve security-history events

GET

/account-info/v3/activity/login

Retrieve login activity for the portal

GET

/account-info/v3/activity/audit-logs

Retrieve audit-log entries

GET

/account-info/v3/activity/security

Retrieve security-history events

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

OAuth access tokens and private app tokens for HubSpot are stored encrypted in the Jentic vault. Audit log calls run through scoped session tokens so the raw HubSpot credential never enters the agent's context.

Intent-based discovery

Agents search Jentic with intents like 'list hubspot login activity since yesterday' and Jentic returns the matching GET /account-info/v3/activity/login operation with its input schema.

Time to first call

Direct integration: half a day to wire OAuth, pagination, and SIEM forwarding. Through Jentic: about an hour — search, load, execute against the three activity endpoints.

FAQs

Specific to using Audit Logs API through Jentic.

What authentication does the HubSpot Audit Logs API use?

The spec defines two security schemes: OAuth 2.0 access tokens and private app tokens sent in the private-app header. Read access to audit and security history requires the corresponding scope on the OAuth token or the private app. Through Jentic the credential is stored encrypted in the vault.

Can I filter audit-log entries by user with this API?

Yes. GET /account-info/v3/activity/audit-logs supports filter parameters including userId and time-window parameters such as occurredAfter and occurredBefore, so an investigation can isolate one user's activity over a specific window.

What are the rate limits for the HubSpot Audit Logs API?

The spec does not declare a per-endpoint limit. Audit log calls count against the standard HubSpot per-account limit of around 100 requests per 10 seconds for OAuth and private apps. Polling jobs should respect that ceiling and use pagination cursors to walk results.

How do I retrieve login activity through Jentic?

Search Jentic for 'list hubspot login activity', load the schema for GET /account-info/v3/activity/login, and execute with occurredAfter set to the last sync timestamp. Jentic returns the paginated JSON response.

Is the HubSpot Audit Logs API available on every plan?

Audit log access is gated by HubSpot plan tier. Enterprise plans expose the full set of audit and security activity, while Professional plans expose a reduced set. Calls on lower tiers may return 403 even with valid credentials.

Can I write audit log entries through this API?

No. All three endpoints are GET requests. The Audit Logs API is read-only — HubSpot writes audit entries automatically when users perform actions in the portal.