HubSpot

Probo reads your HubSpot account’s users through the Settings Users, CRM Owners, and Account Activity APIs so you can review who has access. Connecting with Connect (OAuth) is the recommended method and requires no token management. A private app access token is also available if you would rather not authorize an OAuth app.

Prerequisites

• Probo organization administrator access
• The Super Admin permission in HubSpot (only super admins can create and manage private apps, and OAuth authorization asks for the same access)

Collected Fields

Probo field	HubSpot field	Notes
Name	firstName, lastName	Falls back to the user’s email when neither name is set
Email	email
Role	roleId, roleIds	Resolved to role names through the Roles API; Super Admin is added when superAdmin is true; falls back to User when nothing resolves
Admin	superAdmin
Status	archived (CRM Owners)	Inactive when the user matches an owner record with archived true; otherwise active
MFA	Not supported	HubSpot’s APIs expose no MFA field
Last login	loginAt (Account Activity, successful logins only)	Covers the past 90 days. Left empty when the token has no account-info.security.read scope
External ID	id (Settings Users), or userIdIncludingInactive	Stable identifier used to track the account across reviews
Created at	Not supported

The Settings Users API has no status field, so Probo cross-references the CRM Owners API’s archived list to mark deactivated users inactive. A deactivated user who no longer appears in Settings Users at all is still surfaced, taken from the archived owners list directly.

Connect HubSpot

Option A: Connect with HubSpot (recommended)

1. In Probo, go to Settings > Connectors and click Add more to open the Marketplace.
2. Find HubSpot and open it. If Probo asks how to connect, choose OAuth.
3. Enter a Name for the connection (e.g. main) and click Connect.
4. Sign in as a super admin and authorize Probo on the HubSpot account you want to review. Probo requests the settings.users.read, crm.objects.owners.read, and account-info.security.read scopes. Back in Probo, the HubSpot connector shows as Connected.
5. Go to Access Review > Sources, click Add sources, tick HubSpot, and click Add.

Option B: Private App Access Token

1. In HubSpot (signed in as a super admin), go to Settings > Integrations > Private Apps, and click Create a private app.
2. Name it (e.g. Probo Access Review), open the Scopes tab, and add the read scopes settings.users.read, crm.objects.owners.read, and account-info.security.read.
3. Click Create app, confirm, and copy the access token (pat-…). It’s shown only once.
4. In Probo, go to Settings > Connectors and click Add more to open the Marketplace.
5. Find HubSpot and open it. If Probo asks how to connect, choose API key.
6. Enter a Name for the connection (e.g. main), paste the token into API key, and click Connect.
7. Go to Access Review > Sources, click Add sources, tick HubSpot, and click Add.

Probo names the source after your HubSpot account and pulls its users into your campaigns.

Troubleshooting

• Key rejected. Confirm the private app was created by a super admin and grants all three scopes above; a token missing settings.users.read or crm.objects.owners.read cannot list users.
• Last login is always empty. The token or OAuth authorization is missing the account-info.security.read scope. Probo leaves Last login empty rather than failing the review when that scope is absent.
• A deactivated user still shows Active. Probo only flags a user inactive when a matching CRM Owners record has archived set to true. A user removed by another method that HubSpot has not yet archived as an owner may still appear active until HubSpot updates that record.