Last modified: August 22, 2025
The account activity API allows you to retrieve login history and security activity related to your HubSpot account. To learn how to export this information from within the HubSpot account, check out HubSpot’s Knowledge Base.

​
Retrieve an audit log of user actions

​
Please note:

This endpoint is available for Enterprise accounts only.
To retrieve an audit log of all user actions, make a GET request to /account-info/v3/activity/audit-logs. You can include the following query parameters to filter the results:
  • actingUserId: retrieve user-specific logs by specifying a user ID.
  • occurredAfter: retrieve logs starting from a specific timestamp.
  • occurredBefore: retrieve logs up until a specific timestamp.
The response will contain an object for each user action included in the audit log. This includes actions related to CRM object creation, property value updates, security activity, and more. Learn more about the data included in audit logs on HubSpot’s Knowledge Base. 
{
  "results": [
    {
      "id": "jAzNiQgaEZUTlJISRtESldLGFNM",
      "category": "PIPELINE",
      "subCategory": "DEAL",
      "action": "UPDATE",
      "targetObjectId": "Sales Pipeline",
      "occurredAt": "2025-02-07T20:58:49.529Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "FQVHSQEHchIJDy0EB14CAhcEFC9PAAAMHEgSBjscGkQHOgoWFlkcXFZBWEZBFUNKUEEZ",
      "category": "PROPERTY_VALUE",
      "subCategory": "CONTACT",
      "action": "UPDATE",
      "targetObjectId": "97742230563",
      "occurredAt": "2025-02-07T20:57:49.534Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "IiI9cjoxLzduNVhVW0UeQAZXFkgVSwoGVFVCFUtYSlFATExEUQ1HGEBUURddEB8=",
      "category": "CRM_OBJECT",
      "subCategory": "CONTACT",
      "action": "CREATE",
      "targetObjectId": "97742230563",
      "occurredAt": "2025-02-07T20:57:49.534Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "IJD5yIDYwIDtjXlBQRlxGFVxUSw==",
      "category": "CRITICAL_ACTION",
      "subCategory": "PRIVATE_APP_ACCESS_TOKEN_VIEW",
      "action": "PERFORM",
      "targetObjectId": "916900",
      "occurredAt": "2025-02-07T20:54:39.895Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    },
    {
      "id": "Ij8+eTA9MV8fUxRQlNFHF5RSlJAXX0gMSk7fikwIERFGkBdWkFcRhlbV05Y",
      "category": "CONTENT",
      "subCategory": "BLOG",
      "action": "PUBLISH",
      "targetObjectId": "92061154330",
      "occurredAt": "2025-02-07T14:40:40.279Z",
      "actingUser": {
        "userId": 089274502,
        "userEmail": "mark.scout@lumonindustries.com"
      }
    }
  ]
}
ParameterTypeDescription
idStringThe unique ID of the action event.
categoryStringThe type of user action.
subCategoryStringThe subcategory of user action.
actionStringThe action performed.
targetObjectIdStringThe ID of the object that the user performed the action on.
occurredAtStringThe timestamp of when the action was performed.
actingUserObjectAn object containing the user’s ID and email address.

​
Retrieve login activity

To retrieve an audit log of all user logins, make a GET request to /account-info/v3/activity/login. You can retrieve user-specific login history by including the userId query parameter followed by the user ID. The response will include an object for each login attempt (successful and unsuccessful) made in the past 90 days, including login attempts to app.hubspot.com and the HubSpot mobile app. 
{
  "results": [
    {
      "id": "4862485159",
      "loginAt": "2025-02-07T14:12:13.544Z",
      "userId": 089274502,
      "email": "mark.scout@lumonindustries.com",
      "loginSucceeded": true,
      "ipAddress": "123.45.678.90",
      "location": "new jersey, united states",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "4861025503",
      "loginAt": "2025-02-06T19:39:06.355Z",
      "userId": 089274502,
      "email": "mark.scout@lumonindustries.com",
      "loginSucceeded": true,
      "ipAddress": "123.45.678.90",
      "location": "new jersey, united states",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "4825456493",
      "loginAt": "2025-02-04T14:08:50.356Z",
      "userId": 089274502,
      "email": "mark.scout@lumonindustries.com",
      "loginSucceeded": true,
      "ipAddress": "123.45.678.90",
      "location": "new jersey, united states",
      "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
      "countryCode": "us",
      "regionCode": "nj"
    }
  ]
}
ParameterTypeDescription
idStringThe unique ID of the login event.
loginAtStringThe timestamp of when login was attempted.
userIdIntegerThe ID of the user associated with the activity.
emailStringThe email address of the user associated with the activity.
loginSucceededBooleanWhether the login attempt was successful.
ipAddressStringThe IP address used for the login attempt.
locationStringThe location where the login was attempted.
userAgentStringUser agent information about the device used for login.
countryCodeStringThe country code of the location where the login was attempted.
regionCodeStringThe region code of the location where the login was attempted.

​
Retrieve security activity

To retrieve a history of security-related user activity, make a GET request to /account-info/v3/activity/security. You can include the following query parameters to filter the results:
  • userId: retrieve user-specific history by specifying a user ID.
  • fromTimestamp: retrieve history starting from a specific datetime.
  • toTimestamp: retrieve history up until a specific datetime.
The response will include an object for each activity, including CRM exports, adding and removing users, and installing integrations. Learn more about the data included in security activity history on HubSpot’s Knowledge Base. 
{
  "results": [
    {
      "id": "534928712",
      "createdAt": "2025-02-07T20:54:39.895Z",
      "userId": 089274502,
      "type": "PRIVATE_APP_ACCESS_TOKEN_VIEW",
      "actingUser": "mark.scout@lumonindustries.com",
      "objectId": "916900",
      "infoUrl": "app.hubspot.com/private-apps/123456/916900/auth",
      "location": "new jersey, united states",
      "ipAddress": "123.45.678.90",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "532666822",
      "createdAt": "2025-01-31T21:29:33.724Z",
      "userId": 089274502,
      "type": "INSTALL_INTEGRATION",
      "actingUser": "mark.scout@lumonindustries.com",
      "objectId": "7615143",
      "infoUrl": null,
      "location": "new jersey, united states",
      "ipAddress": "123.45.678.90",
      "countryCode": "us",
      "regionCode": "nj"
    },
    {
      "id": "467517668",
      "createdAt": "2025-01-16T18:11:47.494Z",
      "userId": 089274502,
      "type": "EXPORT_DOWNLOAD",
      "actingUser": "mark.scout@lumonindustries.com",
      "objectId": "74847993",
      "infoUrl": "app.hubspot.com/sales-products-settings/123456/importexport",
      "location": "new jersey, united states",
      "ipAddress": "123.45.678.90",
      "countryCode": "us",
      "regionCode": "nj"
    }
  ]
}
ParameterTypeDescription
idStringThe unique ID of the login event.
createdAtStringThe timestamp of when activity occurred.
userIdIntegerThe ID of the user associated with the activity.
typeStringThe type of activity.
actingUserStringThe email address of the user associated with the activity.
objectIdStringThe ID of the object that the activity was performed on.
infoUrlStringThe URL of the page where the activity occurred.
locationStringThe location where the login was attempted.
ipAddressStringThe IP address used for the login attempt.
userAgentStringUser agent information about the device used for login.
countryCodeStringThe country code of the location where the login was attempted.
regionCodeStringThe region code of the location where the login was attempted.