HubSpot Audit Logs
Browse all Hubspot APIs✓ Official Vendor SpecSecurityComplianceoauth2, apiKey3 EndpointsREST
For Agents
Read HubSpot portal login, audit, and security activity for compliance monitoring, SIEM ingestion, and incident investigation.
Use for: I need to retrieve login activity for a HubSpot portal, Get the audit log entries for the last 24 hours, List all security history events for user 12345, Find users who changed their password this week
Not supported: Does not write audit entries, manage users, or modify security settings — use only for reading HubSpot portal login, audit, and security-history activity.
The HubSpot Audit Logs API returns user-activity records for a HubSpot portal — successful logins, audit events, and security-history entries such as password changes and two-factor updates. The three endpoints under /account-info/v3/activity each return paginated activity records that a SIEM or compliance dashboard can ingest. The data is read-only and is intended for security monitoring rather than user management. Authentication uses OAuth 2.0 or a private app token.
Install Jentic One Beta
Connect the Audit Logs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Audit Logs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Audit Logs API.
Retrieve recent successful login activity for users on a HubSpot portal
Pull audit-log entries showing user actions on the portal
Read security-history entries such as password changes and 2FA updates
Filter activity by user id and time window for incident investigation
Page through activity records to feed a SIEM or warehouse
Use Cases
Patterns agents use Audit Logs API for, with concrete tasks.
★ Feed HubSpot activity into a SIEM
A security team that consolidates events in Splunk or another SIEM can poll the three audit endpoints on a schedule and forward each record. GET /account-info/v3/activity/login returns successful logins, GET /account-info/v3/activity/audit-logs returns user-action audit records, and GET /account-info/v3/activity/security returns security events. The endpoints are paginated, so the poller advances through results until it reaches the last seen timestamp.
Call GET /account-info/v3/activity/audit-logs with occurredAfter set to the last sync timestamp, page through results, and forward each entry to the SIEM
Investigate a suspicious user action
When a HubSpot admin sees an unexpected change, an investigator can query GET /account-info/v3/activity/audit-logs filtered by user id to retrieve every action that user took, then cross-reference GET /account-info/v3/activity/security for password or 2FA changes. The combined timeline supports an incident response without leaving the API.
Call GET /account-info/v3/activity/audit-logs with userId=98765 for the last 7 days, then GET /account-info/v3/activity/security for the same user to assemble a timeline
Compliance reporting for SOC 2 evidence
SOC 2 evidence often requires periodic exports of administrative activity. The audit-logs endpoint returns the list of user actions on the portal, the security endpoint surfaces password and 2FA changes, and the login endpoint confirms access patterns. Together they form an evidence pack that can be archived monthly.
Schedule a monthly job that pulls all three endpoints for the previous calendar month and stores the JSON exports in evidence storage
Agent integration via Jentic
A compliance agent can answer 'who logged into HubSpot this morning' by calling the login endpoint through Jentic. The agent searches for the operation, loads the schema, executes with a since timestamp, and summarises the results. The HubSpot credential stays in the Jentic vault.
Search Jentic for 'list hubspot login activity', load GET /account-info/v3/activity/login, and execute with occurredAfter=this morning's ISO timestamp
Key Endpoints
3 endpoints — the hubspot audit logs api returns user-activity records for a hubspot portal — successful logins, audit events, and security-history entries such as password changes and two-factor updates.
METHOD
PATH
DESCRIPTION
GET
/account-info/v3/activity/login
Retrieve login activity for the portal
GET
/account-info/v3/activity/audit-logs
Retrieve audit-log entries
GET
/account-info/v3/activity/security
Retrieve security-history events
GET
/account-info/v3/activity/login
Retrieve login activity for the portal
GET
/account-info/v3/activity/audit-logs
Retrieve audit-log entries
GET
/account-info/v3/activity/security
Retrieve security-history events
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
OAuth access tokens and private app tokens for HubSpot are stored encrypted in the Jentic vault. Audit log calls run through scoped session tokens so the raw HubSpot credential never enters the agent's context.
Intent-based discovery
Agents search Jentic with intents like 'list hubspot login activity since yesterday' and Jentic returns the matching GET /account-info/v3/activity/login operation with its input schema.
Time to first call
Direct integration: half a day to wire OAuth, pagination, and SIEM forwarding. Through Jentic: about an hour — search, load, execute against the three activity endpoints.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Audit Logs API through Jentic.
What authentication does the HubSpot Audit Logs API use?
The spec defines two security schemes: OAuth 2.0 access tokens and private app tokens sent in the private-app header. Read access to audit and security history requires the corresponding scope on the OAuth token or the private app. Through Jentic the credential is stored encrypted in the vault.
Can I filter audit-log entries by user with this API?
Yes. GET /account-info/v3/activity/audit-logs supports filter parameters including userId and time-window parameters such as occurredAfter and occurredBefore, so an investigation can isolate one user's activity over a specific window.
What are the rate limits for the HubSpot Audit Logs API?
The spec does not declare a per-endpoint limit. Audit log calls count against the standard HubSpot per-account limit of around 100 requests per 10 seconds for OAuth and private apps. Polling jobs should respect that ceiling and use pagination cursors to walk results.
How do I retrieve login activity through Jentic?
Search Jentic for 'list hubspot login activity', load the schema for GET /account-info/v3/activity/login, and execute with occurredAfter set to the last sync timestamp. Jentic returns the paginated JSON response.
Is the HubSpot Audit Logs API available on every plan?
Audit log access is gated by HubSpot plan tier. Enterprise plans expose the full set of audit and security activity, while Professional plans expose a reduced set. Calls on lower tiers may return 403 even with valid credentials.
Can I write audit log entries through this API?
No. All three endpoints are GET requests. The Audit Logs API is read-only — HubSpot writes audit entries automatically when users perform actions in the portal.
GET STARTED