# HubSpot

Probo reads your HubSpot account's users through the Settings Users, CRM Owners, and Account Activity APIs so you can review who has access. Connecting with **Connect** (OAuth) is the recommended method and requires no token management. A private app access token is also available if you would rather not authorize an OAuth app.

## Prerequisites

- Probo organization administrator access
- The **Super Admin** permission in HubSpot (only super admins can create and manage private apps, and OAuth authorization asks for the same access)

## Collected Fields

| Probo field | HubSpot field                                            | Notes                                                                                                                                     |
| ----------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Name        | `firstName`, `lastName`                                  | Falls back to the user's email when neither name is set                                                                                    |
| Email       | `email`                                                   |                                                                                                                                              |
| Role        | `roleId`, `roleIds`                                       | Resolved to role names through the Roles API; `Super Admin` is added when `superAdmin` is true; falls back to `User` when nothing resolves |
| Admin       | `superAdmin`                                              |                                                                                                                                              |
| Status      | `archived` (CRM Owners)                                   | Inactive when the user matches an owner record with `archived` true; otherwise active                                                     |
| MFA         |   | HubSpot's APIs expose no MFA field                                                                                                          |
| Last login  | `loginAt` (Account Activity, successful logins only)      | Covers the past 90 days. Left empty when the token has no `account-info.security.read` scope                                              |
| External ID | `id` (Settings Users), or `userIdIncludingInactive`       | Stable identifier used to track the account across reviews                                                                                 |
| Created at  |   |                                                                                                                                              |

The Settings Users API has no status field, so Probo cross-references the CRM Owners API's archived list to mark deactivated users inactive. A deactivated user who no longer appears in Settings Users at all is still surfaced, taken from the archived owners list directly.

## Connect HubSpot

### Option A: Connect with HubSpot (recommended)

1. In Probo, go to **Access Reviews** > **Sources** > **Add Source**.
2. Find **HubSpot** and click **Connect**.
3. Sign in as a super admin and authorize Probo on the HubSpot account you want to review. Probo requests the **`settings.users.read`**, **`crm.objects.owners.read`**, and **`account-info.security.read`** scopes.

### Option B: Private App Access Token

1. In HubSpot (signed in as a super admin), go to **Settings** > **Integrations** > **Private Apps**, and click **Create a private app**.
2. Name it (e.g. `Probo Access Review`), open the **Scopes** tab, and add the read scopes **`settings.users.read`**, **`crm.objects.owners.read`**, and **`account-info.security.read`**.
3. Click **Create app**, confirm, and copy the access token (`pat-…`). It's shown only once.
4. In Probo, go to **Access Reviews** > **Sources** > **Add Source**, find **HubSpot**, open the dropdown next to **Connect**, and click **Connect with API Key**.
5. Paste the token and click **Connect**.

Probo names the source after your HubSpot account and pulls its users into your campaigns.

## Troubleshooting

- **Key rejected.** Confirm the private app was created by a super admin and grants all three scopes above; a token missing `settings.users.read` or `crm.objects.owners.read` cannot list users.
- **Last login is always empty.** The token or OAuth authorization is missing the `account-info.security.read` scope. Probo leaves Last login empty rather than failing the review when that scope is absent.
- **A deactivated user still shows Active.** Probo only flags a user inactive when a matching CRM Owners record has `archived` set to true. A user removed by another method that HubSpot has not yet archived as an owner may still appear active until HubSpot updates that record.