canonical: https://jentic.com/apis/hubspot.com/hubspot-audit-logs

# HubSpot Audit Logs

The HubSpot Audit Logs API returns user-activity records for a HubSpot portal - successful logins, audit events, and security-history entries such as password changes and two-factor updates. The three endpoints under /account-info/v3/activity each return paginated activity records that a SIEM or compliance dashboard can ingest. The data is read-only and is intended for security monitoring rather than user management. Authentication uses OAuth 2.0 or a private app token.

## For AI agents

Read HubSpot portal login, audit, and security activity for compliance monitoring, SIEM ingestion, and incident investigation.

## Scope

Does not write audit entries, manage users, or modify security settings - use only for reading HubSpot portal login, audit, and security-history activity.

## Capabilities

- Retrieve recent successful login activity for users on a HubSpot portal
- Pull audit-log entries showing user actions on the portal
- Read security-history entries such as password changes and 2FA updates
- Filter activity by user id and time window for incident investigation
- Page through activity records to feed a SIEM or warehouse

## Use cases

### Feed HubSpot activity into a SIEM

A security team that consolidates events in Splunk or another SIEM can poll the three audit endpoints on a schedule and forward each record. GET /account-info/v3/activity/login returns successful logins, GET /account-info/v3/activity/audit-logs returns user-action audit records, and GET /account-info/v3/activity/security returns security events. The endpoints are paginated, so the poller advances through results until it reaches the last seen timestamp.

Example prompt: Call GET /account-info/v3/activity/audit-logs with occurredAfter set to the last sync timestamp, page through results, and forward each entry to the SIEM

### Investigate a suspicious user action

When a HubSpot admin sees an unexpected change, an investigator can query GET /account-info/v3/activity/audit-logs filtered by user id to retrieve every action that user took, then cross-reference GET /account-info/v3/activity/security for password or 2FA changes. The combined timeline supports an incident response without leaving the API.

Example prompt: Call GET /account-info/v3/activity/audit-logs with userId=98765 for the last 7 days, then GET /account-info/v3/activity/security for the same user to assemble a timeline

### Compliance reporting for SOC 2 evidence

SOC 2 evidence often requires periodic exports of administrative activity. The audit-logs endpoint returns the list of user actions on the portal, the security endpoint surfaces password and 2FA changes, and the login endpoint confirms access patterns. Together they form an evidence pack that can be archived monthly.

Example prompt: Schedule a monthly job that pulls all three endpoints for the previous calendar month and stores the JSON exports in evidence storage

### Agent integration via Jentic

A compliance agent can answer 'who logged into HubSpot this morning' by calling the login endpoint through Jentic. The agent searches for the operation, loads the schema, executes with a since timestamp, and summarises the results. The HubSpot credential stays in your Jentic One instance.

Example prompt: Search Jentic for 'list hubspot login activity', load GET /account-info/v3/activity/login, and execute with occurredAfter=this morning's ISO timestamp

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /account-info/v3/activity/login | Retrieve login activity for the portal |
| GET | /account-info/v3/activity/audit-logs | Retrieve audit-log entries |
| GET | /account-info/v3/activity/security | Retrieve security-history events |

## Key resources

- **Activity** — Read login activity, audit-log entries, and security-history events for the portal

## Why Jentic

- **Setup:** Wiring the HubSpot Audit Logs API by hand means handling both OAuth and app-token auth against api.hubapi.com and paging the login, audit, and security history yourself. Through Jentic you install once, import Audit Logs from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** All three operations read portal activity and take no resource id, so limit the agent to the operations it needs, such as reading login activity or audit logs. This API is read-only, so there are no write or delete calls to grant.
- **Credential handling:** Your HubSpot credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list hubspot login activity since yesterday', and Jentic returns GET /account-info/v3/activity/login with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **HubSpot Account Info** — Account Info returns portal metadata that contextualises audit log entries
- **HubSpot OAuth** — Inspect and refresh the access tokens used to call the audit endpoints
- **Okta API** — Okta exposes its own system log API for SSO-driven audit evidence
- **Auth0 Management API** — Auth0 Logs API surfaces authentication and admin events for tenants using Auth0

## FAQ

### What authentication does the HubSpot Audit Logs API use?

The spec defines two security schemes: OAuth 2.0 access tokens and private app tokens sent in the private-app header. Read access to audit and security history requires the corresponding scope on the OAuth token or the private app. Through Jentic the credential is stored encrypted in the vault.

### Can I filter audit-log entries by user with this API?

Yes. GET /account-info/v3/activity/audit-logs supports filter parameters including userId and time-window parameters such as occurredAfter and occurredBefore, so an investigation can isolate one user's activity over a specific window.

### What are the rate limits for the HubSpot Audit Logs API?

The spec does not declare a per-endpoint limit. Audit log calls count against the standard HubSpot per-account limit of around 100 requests per 10 seconds for OAuth and private apps. Polling jobs should respect that ceiling and use pagination cursors to walk results.

### How do I retrieve login activity through Jentic?

Search Jentic for 'list hubspot login activity', load the schema for GET /account-info/v3/activity/login, and execute with occurredAfter set to the last sync timestamp. Jentic returns the paginated JSON response.

### Is the HubSpot Audit Logs API available on every plan?

Audit log access is gated by HubSpot plan tier. Enterprise plans expose the full set of audit and security activity, while Professional plans expose a reduced set. Calls on lower tiers may return 403 even with valid credentials.

### Can I write audit log entries through this API?

No. All three endpoints are GET requests. The Audit Logs API is read-only - HubSpot writes audit entries automatically when users perform actions in the portal.

### Can I limit what my agent is allowed to do with the HubSpot Audit Logs API?

Yes. Because you self-host Jentic One, your own rules decide which of the three read operations the agent may call: GET /account-info/v3/activity/login, GET /account-info/v3/activity/audit-logs, and GET /account-info/v3/activity/security. You can grant only the operations the agent needs, such as reading login activity while withholding the audit-log and security-history endpoints. Since all three operations are read-only and take no resource id, there are no write or delete calls to authorize, and the HubSpot credential is injected at execution time under the same controls.