Account activity API - HubSpot docs

Scope requirements

The account activity API allows you to retrieve login history and security activity related to your HubSpot account. To learn how to export this information from within the HubSpot account, check out HubSpot’s Knowledge Base.

Please note:This endpoint is available for Enterprise accounts only.

To retrieve an audit log of all user actions, make a GET request to /account-info/v3/activity/audit-logs. You can include the following query parameters to filter the results:

actingUserId: retrieve user-specific logs by specifying a user ID.
occurredAfter: retrieve logs starting from a specific timestamp.
occurredBefore: retrieve logs up until a specific timestamp.

The response will contain an object for each user action included in the audit log. This includes actions related to CRM object creation, property value updates, security activity, and more. Learn more about the data included in audit logs on HubSpot’s Knowledge Base.

{
  "results": [
    {
      "id": "jAzNiQgaEZUTlJISRtESldLGFNM",
      "category": "PIPELINE",
      "subCategory": "DEAL",
      "action": "UPDATE",
      "targetObjectId": "Sales Pipeline",
      "occurredAt": "2025-02-07T20:58:49.529Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "FQVHSQEHchIJDy0EB14CAhcEFC9PAAAMHEgSBjscGkQHOgoWFlkcXFZBWEZBFUNKUEEZ",
      "category": "PROPERTY_VALUE",
      "subCategory": "CONTACT",
      "action": "UPDATE",
      "targetObjectId": "97742230563",
      "occurredAt": "2025-02-07T20:57:49.534Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "IiI9cjoxLzduNVhVW0UeQAZXFkgVSwoGVFVCFUtYSlFATExEUQ1HGEBUURddEB8=",
      "category": "CRM_OBJECT",
      "subCategory": "CONTACT",
      "action": "CREATE",
      "targetObjectId": "97742230563",
      "occurredAt": "2025-02-07T20:57:49.534Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "IJD5yIDYwIDtjXlBQRlxGFVxUSw==",
      "category": "CRITICAL_ACTION",
      "subCategory": "PRIVATE_APP_ACCESS_TOKEN_VIEW",
      "action": "PERFORM",
      "targetObjectId": "916900",
      "occurredAt": "2025-02-07T20:54:39.895Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "Ij8+eTA9MV8fUxRQlNFHF5RSlJAXX0gMSk7fikwIERFGkBdWkFcRhlbV05Y",
      "category": "CONTENT",
      "subCategory": "BLOG",
      "action": "PUBLISH",
      "targetObjectId": "92061154330",
      "occurredAt": "2025-02-07T14:40:40.279Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    }
  ]
}

Parameter	Type	Description
`id`	String	The unique ID of the action event.
`category`	String	The type of user action.
`subCategory`	String	The subcategory of user action.
`action`	String	The action performed.
`targetObjectId`	String	The ID of the object that the user performed the action on.
`occurredAt`	String	The timestamp of when the action was performed.
`actingUser`	Object	An object containing the user’s ID and email address.

To retrieve an audit log of all user logins, make a GET request to /account-info/v3/activity/login. You can retrieve user-specific login history by including the userId query parameter followed by the user ID. The response will include an object for each login attempt (successful and unsuccessful) made in the past 90 days, including login attempts to app.hubspot.com and the HubSpot mobile app.

{
  "results": [
    {
      "id": "4862485159",
      "loginAt": "2025-02-07T14:12:13.544Z",
      "userId": 089274502,
      "email": "mark.scout@lumonindustries.com",
      "loginSucceeded": true,
      "ipAddress": "123.45.678.90",
      "location": "new jersey, united states",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "4861025503",
      "loginAt": "2025-02-06T19:39:06.355Z",
      "userId": 089274502,
      "email": "mark.scout@lumonindustries.com",
      "loginSucceeded": true,
      "ipAddress": "123.45.678.90",
      "location": "new jersey, united states",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "4825456493",
      "loginAt": "2025-02-04T14:08:50.356Z",
      "userId": 089274502,
      "email": "mark.scout@lumonindustries.com",
      "loginSucceeded": true,
      "ipAddress": "123.45.678.90",
      "location": "new jersey, united states",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
      "countryCode": "us",
      "regionCode": "nj"
    }
  ]
}

Parameter	Type	Description
`id`	String	The unique ID of the login event.
`loginAt`	String	The timestamp of when login was attempted.
`userId`	Integer	The ID of the user associated with the activity.
`email`	String	The email address of the user associated with the activity.
`loginSucceeded`	Boolean	Whether the login attempt was successful.
`ipAddress`	String	The IP address used for the login attempt.
`location`	String	The location where the login was attempted.
`userAgent`	String	User agent information about the device used for login.
`countryCode`	String	The country code of the location where the login was attempted.
`regionCode`	String	The region code of the location where the login was attempted.

Retrieve security activity

To retrieve a history of security-related user activity, make a GET request to /account-info/v3/activity/security. You can include the following query parameters to filter the results:

userId: retrieve user-specific history by specifying a user ID.
fromTimestamp: retrieve history starting from a specific datetime.
toTimestamp: retrieve history up until a specific datetime.

The response will include an object for each activity, including CRM exports, adding and removing users, and installing integrations. Learn more about the data included in security activity history on HubSpot’s Knowledge Base.

{
  "results": [
    {
      "id": "534928712",
      "createdAt": "2025-02-07T20:54:39.895Z",
      "userId": 089274502,
      "type": "PRIVATE_APP_ACCESS_TOKEN_VIEW",
      "actingUser": "mark.scout@lumonindustries.com",
      "objectId": "916900",
      "infoUrl": "app.hubspot.com/private-apps/123456/916900/auth",
      "location": "new jersey, united states",
      "ipAddress": "123.45.678.90",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "532666822",
      "createdAt": "2025-01-31T21:29:33.724Z",
      "userId": 089274502,
      "type": "INSTALL_INTEGRATION",
      "actingUser": "mark.scout@lumonindustries.com",
      "objectId": "7615143",
      "infoUrl": null,
      "location": "new jersey, united states",
      "ipAddress": "123.45.678.90",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "467517668",
      "createdAt": "2025-01-16T18:11:47.494Z",
      "userId": 089274502,
      "type": "EXPORT_DOWNLOAD",
      "actingUser": "mark.scout@lumonindustries.com",
      "objectId": "74847993",
      "infoUrl": "app.hubspot.com/sales-products-settings/123456/importexport",
      "location": "new jersey, united states",
      "ipAddress": "123.45.678.90",
      "countryCode": "us",
      "regionCode": "nj"
    }
  ]
}

Parameter	Type	Description
`id`	String	The unique ID of the login event.
`createdAt`	String	The timestamp of when activity occurred.
`userId`	Integer	The ID of the user associated with the activity.
`type`	String	The type of activity.
`actingUser`	String	The email address of the user associated with the activity.
`objectId`	String	The ID of the object that the activity was performed on.
`infoUrl`	String	The URL of the page where the activity occurred.
`location`	String	The location where the login was attempted.
`ipAddress`	String	The IP address used for the login attempt.
`userAgent`	String	User agent information about the device used for login.
`countryCode`	String	The country code of the location where the login was attempted.
`regionCode`	String	The region code of the location where the login was attempted.

​Retrieve an audit log of user actions

​Retrieve login activity

​Retrieve security activity

Retrieve an audit log of user actions

Retrieve login activity

Retrieve security activity