Webhooks

The Webhooks API allows you to subscribe to events happening in a HubSpot account with your integration installed. Rather than making an API call when an event happens in a connected account, HubSpot can send an HTTP request to an endpoint you configure. You can configure subscribed events in your app’s settings or using the endpoints detailed below. Webhooks can be more scalable than regularly polling for changes, especially for apps with a large install base.

Using the Webhooks API requires the following:

• You must set up a HubSpot app to use webhooks by subscribing to the events you want to be notified about, and by specifying a URL to send those notifications. See the prerequisites documentation for more details about creating an app.
• You must deploy a publicly available and secure (HTTPS) endpoint for that URL that can handle the webhook payloads specified in this documentation.

Webhooks are set up for a HubSpot app, not individual accounts. Any account that install your app by going through the OAuth flow will be subscribed to its webhook subscriptions.

You can subscribe to CRM object events, which includes contacts, companies, deals, tickets, products and line items, as well as conversations events.

In order to use webhooks to subscribe to CRM events, your app will need to be configured to require the crm.objects.contacts.read scope. Your app will need to be configured to require the conversations.read scope to subscribe to conversations events.

You must set up these scopes before you can create a webhook subscription. Review the OAuth documentation for more details about scopes and setting up the authorization URL for your app.

If your app is already using webhooks, you won't be able to remove the crm.objects.contacts.read or conversations.read scope until you remove all webhook subscriptions from your app.

Before setting up your webhook subscriptions, you need to specify a URL to send those notifications to. Follow the instructions in the sections below to learn how to fully configure subscriptions for your app.

 You can manage your URL and event throttling limit in your app’s configuration page in your developer account:

• In your developer account, navigate to your App dashboard.
• Click the name of the app you want to set up webhooks for. 
  
• In the left sidebar menu, navigate to Webhooks.
• In the Target URL field, enter the URL that HubSpot will make a POST request to when events trigger.
• Use the Event throttling setting to adjust the maximum number of events HubSpot will attempt to send. 

• Click Save. 

You can use the following endpoints and your developer API key to programmatically configure webhook settings for an app.

To view any webhook settings currently configured for an app, make a GET request to webhooks/v3/{appId}/settings.

You'll need to include the app ID in the request, which you can find below the name of the app in your Apps dashboard, or on the Auth tab in your app's settings.

The settings object contains the following fields:

To make edits to these settings, make a PUT request to webhooks/v3/{appId}/settings and include the following fields in the request body:

For example, your request might look similar to the following:

Once you’ve set up your webhook URL and event throttling limit, you’ll need to create one or more subscriptions. Webhook subscriptions tell HubSpot which events your particular app would like to receive.

Subscriptions apply to all customers who have installed your integration. This means that you only need to specify what subscriptions you need once. Once you've turned on a subscription for an application, it will automatically start getting webhooks for all customers that have installed your application, and your integration will start receiving webhook triggers from any new customers. 

The following subscription types are supported and can be used as the value for the eventType field when creating subscriptions via API: 

The following conversations subscription types are available to you to subscribe to if you're using the conversations inbox and messages API, which is currently in beta: 

For property change subscriptions, you will need to specify which property you want to be notified of. You can specify multiple property change subscriptions. If a customer's account doesn't have the property you specify in a subscription, you will not get any webhooks from that customer for that property.

Certain properties are not available for CRM property change subscriptions. These properties are:

• num_unique_conversion_events
• hs_lastmodifieddate

If you are using the conversations messages and inbox API, which is currently in beta, the following properties are available:

• assignedTo: the conversation thread has been reassigned or unassigned. If the thread was reassigned, the propertyValue will be an actor ID in the webhooks payload; if unassigned, it will be empty.
• status: the status of the conversation thread has changed. In the webhooks payload, the propertyValue will either be OPEN or CLOSED.
• isArchived: the conversation thread has been restored. The propertyValue in the webhooks payload will always be FALSE. 

You can create webhook subscriptions in your HubSpot developer account. 

• In your HubSpot developer account, navigate to the Apps dashboard. 
• Click the name of an app. 
• In the left sidebar menu, navigate to Webhooks. 
• Click Create subscription. 
• In the right panel, click the Which object types? dropdown menu and select the objects you want to create a subscription for. 
• Click the Listen for which events? dropdown menu and select the event types. 

• If you're creating a subscription for property change events, click the Which properties? dropdown menu and select the properties to listen for. 
  
• Click Subscribe. 

The subscription will appear in your webhooks settings. New subscriptions are created in a paused state, so you will need to activate the subscription for webhooks to send:

• In the Event subscriptions section, hover over the object type and click View subscriptions. 
• Select the checkbox next to the event, then in the table header click Activate. 

You can programmatically create subscriptions using the following endpoints. You will need to use your developer API key when making requests to these endpoints. 

A subscription object can include the following fields:

To retrieve the list of subscriptions, make a GET request to webhooks/v3/{appId}/subscriptions.

The response will be an array of objects representing your subscriptions. Each object will include information on the subscription like the ID, create date, type, and whether or not it’s currently active. Here’s what an example response would look like:

To create a new subscription, make a POST request to webhooks/v3/{appId}/subscriptions.

In the request body, you can include the following fields:

You don't need to include id, createdAt, or createdBy, as those fields are set automatically.

For example, your request body may appear similar to the following: 

The eventType must be a valid subscription type as defined in the above section and the propertyName must be a valid property name. If a customer has no property defined that matches this value, then this subscription will not result in any notifications.

In the request body, include the following:

To delete a subscription, make a DELETE request to webhooks/v3/{appId}/subscriptions/{subscriptionId}.

The endpoint at the target URL that you specify in your app's webhooks settings will receive POST requests containing JSON formatted data from HubSpot.

To ensure that the requests you're getting at your webhook endpoint are actually coming from HubSpot, HubSpot populates a X-HubSpot-Signature header with a SHA-256 hash built using the client secret of your app combined with details of the request. Learn more about validating request signatures. 

Use the tables below to view details about fields that may be contained in the payload.

As shown above, you should expect to receive an array of objects in a single request. The batch size can vary, but will be under 100 notifications. HubSpot will send multiple notifications when a lot of events have occurred within a short period of time. For example, if you've subscribed to new contacts and a customer imports a large number of contacts, HubSpot will send you the notifications for these imported contacts in batches and not one per request.

HubSpot does not guarantee that you'll receive these notifications in the order they occurred. Use the occurredAt property for each notification to determine when the event that triggered the notification occurred.

HubSpot also does not guarantee that you'll only get a single notification for an event. Though this should be rare, it is possible that HubSpot will send you the same notification multiple times.

HubSpot users have the ability to permanently delete a contact record to comply with privacy laws. Learn more about performing a GDPR compliant delete.

You can subscribe to the contact.privacyDeletion subscription type to receive webhook notifications when a user performs a privacy compliant contact deletion.

Privacy deletion notifications have some special behavior:

• A privacy deletion event will also trigger the contact deletion event, so you will receive two notifications if you are subscribed to both events.
• These notifications will not necessarily be sent in any specific order or in the same batch of messages. You will need to use the object ID to match the separate messages.

To ensure that the requests you're getting at your webhook endpoint are actually coming from HubSpot, HubSpot populates a X-HubSpot-Signature header with a SHA-256 hash of the concatenation of the app-secret for your application and the request body HubSpot is sending.

To verify this signature, concatenate the app secret of your application and the un-parsed request body of the request you're handling, and get a SHA-256 hash of the result. Compare the resulting hash with the value of the X-HubSpot-Signature. If these values match, then this verifies that this request came from HubSpot. Or, the request came from someone else who knows your application secret. It's important to keep this value secret.

If these values do not match, then this request may have been tampered with in-transit or someone may be spoofing webhook notifications to your endpoint.

Learn more about validating signature requests. 

If your service has problems handling notifications at any time, HubSpot will attempt to re-send failed notifications up to 10 times.

HubSpot will retry in the following cases:

• Connection failed: HubSpot cannot open an HTTP connection to the provided webhook URL. 
• Timeout: your service takes longer than five seconds to send back a response to a batch of notifications. 
• Error codes: your service responds with any HTTP status code (4xx or 5xx).

Notifications will be retried up to 10 times. These retries will be spread out over the next 24 hours, with varying delays between requests. Individual notifications will have some randomization applied, to prevent a large number of concurrent failures from being retried at the exact same time.

POST requests that HubSpot sends to your service via your webhook subscriptions will not count against your app's API rate limits.

You can create a maximum of 1000 subscriptions per application. If you attempt to create more you will receive a 400 bad request in return with the following body: