The account activity API allows you to retrieve login history and security activity related to your HubSpot account. To learn how to export this information from within the HubSpot account, check out HubSpot's Knowledge Base.
Please note: this endpoint is available for Enterprise accounts only.
To retrieve an audit log of all user actions, make a GET
request to /account-info/v3/activity/audit-logs
. You can include the following query parameters to filter the results:
actingUserId
: retrieve user-specific logs by specifying a user ID.occurredAfter
: retrieve logs starting from a specific timestamp.occurredBefore
: retrieve logs up until a specific timestamp.
The response will contain an object for each user action included in the audit log. This includes actions related to CRM object creation, property value updates, security activity, and more. Learn more about the data included in audit logs on HubSpot's Knowledge Base.
{
"results": [
{
"id": "jAzNiQgaEZUTlJISRtESldLGFNM",
"category": "PIPELINE",
"subCategory": "DEAL",
"action": "UPDATE",
"targetObjectId": "Sales Pipeline",
"occurredAt": "2025-02-07T20:58:49.529Z",
"actingUser": {
"userId": 089274502,
"userEmail": "mark.scout@lumonindustries.com"
}
},
{
"id": "FQVHSQEHchIJDy0EB14CAhcEFC9PAAAMHEgSBjscGkQHOgoWFlkcXFZBWEZBFUNKUEEZ",
"category": "PROPERTY_VALUE",
"subCategory": "CONTACT",
"action": "UPDATE",
"targetObjectId": "97742230563",
"occurredAt": "2025-02-07T20:57:49.534Z",
"actingUser": {
"userId": 089274502,
"userEmail": "mark.scout@lumonindustries.com"
}
},
{
"id": "IiI9cjoxLzduNVhVW0UeQAZXFkgVSwoGVFVCFUtYSlFATExEUQ1HGEBUURddEB8=",
"category": "CRM_OBJECT",
"subCategory": "CONTACT",
"action": "CREATE",
"targetObjectId": "97742230563",
"occurredAt": "2025-02-07T20:57:49.534Z",
"actingUser": {
"userId": 089274502,
"userEmail": "mark.scout@lumonindustries.com"
}
},
{
"id": "IJD5yIDYwIDtjXlBQRlxGFVxUSw==",
"category": "CRITICAL_ACTION",
"subCategory": "PRIVATE_APP_ACCESS_TOKEN_VIEW",
"action": "PERFORM",
"targetObjectId": "916900",
"occurredAt": "2025-02-07T20:54:39.895Z",
"actingUser": {
"userId": 089274502,
"userEmail": "mark.scout@lumonindustries.com"
}
},
{
"id": "Ij8+eTA9MV8fUxRQlNFHF5RSlJAXX0gMSk7fikwIERFGkBdWkFcRhlbV05Y",
"category": "CONTENT",
"subCategory": "BLOG",
"action": "PUBLISH",
"targetObjectId": "92061154330",
"occurredAt": "2025-02-07T14:40:40.279Z",
"actingUser": {
"userId": 089274502,
"userEmail": "mark.scout@lumonindustries.com"
}
}
]
}
Parameter | Type | Description |
---|---|---|
id | String | The unique ID of the action event. |
category | String | The type of user action. |
subCategory | String | The subcategory of user action. |
action | String | The action performed. |
targetObjectId | String | The ID of the object that the user performed the action on. |
occurredAt | String | The timestamp of when the action was performed. |
actingUser | Object | An object containing the user's ID and email address. |
To retrieve an audit log of all user logins, make a GET
request to /account-info/v3/activity/login
. You can retrieve user-specific login history by including the userId
query parameter followed by the user ID.
The response will include an object for each login attempt (successful and unsuccessful) made in the past 90 days, including login attempts to app.hubspot.com and the HubSpot mobile app.
xxxxxxxxxx
{
"results": [
{
"id": "4862485159",
"loginAt": "2025-02-07T14:12:13.544Z",
"userId": 089274502,
"email": "mark.scout@lumonindustries.com",
"loginSucceeded": true,
"ipAddress": "123.45.678.90",
"location": "new jersey, united states",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
"countryCode": "us",
"regionCode": "nj"
},
{
"id": "4861025503",
"loginAt": "2025-02-06T19:39:06.355Z",
"userId": 089274502,
"email": "mark.scout@lumonindustries.com",
"loginSucceeded": true,
"ipAddress": "123.45.678.90",
"location": "new jersey, united states",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
"countryCode": "us",
"regionCode": "nj"
},
{
"id": "4825456493",
"loginAt": "2025-02-04T14:08:50.356Z",
"userId": 089274502,
"email": "mark.scout@lumonindustries.com",
"loginSucceeded": true,
"ipAddress": "123.45.678.90",
"location": "new jersey, united states",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
"countryCode": "us",
"regionCode": "nj"
}
]
}
Parameter | Type | Description |
---|---|---|
id | String | The unique ID of the login event. |
loginAt | String | The timestamp of when login was attempted. |
userId | Integer | The ID of the user associated with the activity. |
email | String | The email address of the user associated with the activity. |
loginSucceeded | Boolean | Whether the login attempt was successful. |
ipAddress | String | The IP address used for the login attempt. |
location | String | The location where the login was attempted. |
userAgent | String | User agent information about the device used for login. |
countryCode | String | The country code of the location where the login was attempted. |
regionCode | String | The region code of the location where the login was attempted. |
To retrieve a history of security-related user activity, make a GET
request to /account-info/v3/activity/security
. You can include the following query parameters to filter the results:
userId
: retrieve user-specific history by specifying a user ID.fromTimestamp
: retrieve history starting from a specific datetime.toTimestamp
: retrieve history up until a specific datetime.
The response will include an object for each activity, including CRM exports, adding and removing users, and installing integrations. Learn more about the data included in security activity history on HubSpot's Knowledge Base.
xxxxxxxxxx
{
"results": [
{
"id": "534928712",
"createdAt": "2025-02-07T20:54:39.895Z",
"userId": 089274502,
"type": "PRIVATE_APP_ACCESS_TOKEN_VIEW",
"actingUser": "mark.scout@lumonindustries.com",
"objectId": "916900",
"infoUrl": "app.hubspot.com/private-apps/123456/916900/auth",
"location": "new jersey, united states",
"ipAddress": "123.45.678.90",
"countryCode": "us",
"regionCode": "nj"
},
{
"id": "532666822",
"createdAt": "2025-01-31T21:29:33.724Z",
"userId": 089274502,
"type": "INSTALL_INTEGRATION",
"actingUser": "mark.scout@lumonindustries.com",
"objectId": "7615143",
"infoUrl": null,
"location": "new jersey, united states",
"ipAddress": "123.45.678.90",
"countryCode": "us",
"regionCode": "nj"
},
{
"id": "467517668",
"createdAt": "2025-01-16T18:11:47.494Z",
"userId": 089274502,
"type": "EXPORT_DOWNLOAD",
"actingUser": "mark.scout@lumonindustries.com",
"objectId": "74847993",
"infoUrl": "app.hubspot.com/sales-products-settings/123456/importexport",
"location": "new jersey, united states",
"ipAddress": "123.45.678.90",
"countryCode": "us",
"regionCode": "nj"
}
]
}
Parameter | Type | Description |
---|---|---|
id | String | The unique ID of the login event. |
createdAt | String | The timestamp of when activity occurred. |
userId | Integer | The ID of the user associated with the activity. |
type | String | The type of activity. |
actingUser | String | The email address of the user associated with the activity. |
objectId | String | The ID of the object that the activity was performed on. |
infoUrl | String | The URL of the page where the activity occurred. |
location | String | The location where the login was attempted. |
ipAddress | String | The IP address used for the login attempt. |
userAgent | String | User agent information about the device used for login. |
countryCode | String | The country code of the location where the login was attempted. |
regionCode | String | The region code of the location where the login was attempted. |