HubSpot

the platform reads your HubSpot account’s users through the Settings Users, CRM Owners, and Account Activity APIs so you can review who has access. Connecting with Connect (OAuth) is the recommended method and requires no token management. A private app access token is also available if you would rather not authorize an OAuth app.

Prerequisites

• the platform organization administrator access
• The Super Admin permission in HubSpot (only super admins can create and manage private apps, and OAuth authorization asks for the same access)

Collected Fields

the platform field	HubSpot field	Notes
Name	firstName, lastName	Falls back to the user’s email when neither name is set
Email	email
Role	roleId, roleIds	Resolved to role names through the Roles API; Super Admin is added when superAdmin is true; falls back to User when nothing resolves
Admin	superAdmin
Status	archived (CRM Owners)	Inactive when the user matches an owner record with archived true; otherwise active
MFA	Not supported	HubSpot’s APIs expose no MFA field
Last login	loginAt (Account Activity, successful logins only)	Covers the past 90 days. Left empty when the token has no account-info.security.read scope
External ID	id (Settings Users), or userIdIncludingInactive	Stable identifier used to track the account across reviews
Created at	Not supported

The Settings Users API has no status field, so the platform cross-references the CRM Owners API’s archived list to mark deactivated users inactive. A deactivated user who no longer appears in Settings Users at all is still surfaced, taken from the archived owners list directly.

Connect HubSpot

Option A: Connect with HubSpot (recommended)

1. In the platform, go to Access Reviews > Sources > Add Source.
2. Find HubSpot and click Connect.
3. Sign in as a super admin and authorize the platform on the HubSpot account you want to review. the platform requests the settings.users.read, crm.objects.owners.read, and account-info.security.read scopes.

Option B: Private App Access Token

1. In HubSpot (signed in as a super admin), go to Settings > Integrations > Private Apps, and click Create a private app.
2. Name it (e.g. Probo Access Review), open the Scopes tab, and add the read scopes settings.users.read, crm.objects.owners.read, and account-info.security.read.
3. Click Create app, confirm, and copy the access token (pat-…). It’s shown only once.
4. In the platform, go to Access Reviews > Sources > Add Source, find HubSpot, open the dropdown next to Connect, and click Connect with API Key.
5. Paste the token and click Connect.

the platform names the source after your HubSpot account and pulls its users into your campaigns.

Troubleshooting

• Key rejected. Confirm the private app was created by a super admin and grants all three scopes above; a token missing settings.users.read or crm.objects.owners.read cannot list users.
• Last login is always empty. The token or OAuth authorization is missing the account-info.security.read scope. the platform leaves Last login empty rather than failing the review when that scope is absent.
• A deactivated user still shows Active. the platform only flags a user inactive when a matching CRM Owners record has archived set to true. A user removed by another method that HubSpot has not yet archived as an owner may still appear active until HubSpot updates that record.