We've updated our Webhooks execution flow to enhance security by ensuring that association events containing non-public CRM objects are no longer sent to external integrators. This change shouldn’t require immediate action from customers, but it may impact existing and future Webhook subscriptions and needs to be reviewed.

What's changing?

Our Webhooks inadvertently sent updates about CRM object associations that should remain internal in public APIs/views. To address this oversight, future Webhook updates will no longer include association events for these internal CRM objects, such as MARKETING_SMS, CAMPAIGN_SPEND_ITEM, FORM, SOCIAL_POST, etc.

For example, if you have a Webhook set up to monitor SMS-related activity within a HubSpot account, and the Webhook listens for updates such as MARKETING_SMS to manage marketing SMS activity. With this new security enhancement, the Webhook will no longer send updates for events that invoke internal CRM objects, such as MARKETING_SMS. This means that association events related to internal objects will not trigger your Webhook, preventing any external access to sensitive internal CRM data.

This change will be a breaking change, affecting only existing and future Webhook subscriptions that may have been using updates on internal CRM objects. Specifically, any Webhooks configured to listen for updates on non-public CRM objects will no longer receive these updates after the change.

How does this impact developers?

Developers should review their current integrations and determine if they rely on receiving Webhook data for any non-public objects that will be affected by this change. If so, modifications to their integration logic may be necessary to accommodate the absence of this data. Check your systems for dependencies on internal objects and plan updates accordingly to ensure no application disruptions.

When is it happening?

This update takes effect today on April 23rd, 2025.  Questions or comments? Join us in the developer forums for a peer-to-peer discussion.