Skip to main content

HubSpot API Endpoints

Reference list of the HubSpot CRM, webhook, and OAuth API endpoints the iPaaS.com HubSpot integration calls, grouped by entity, with authorization, pagination, and rate limit details.

This article lists the HubSpot API endpoints the iPaaS.com HubSpot integration calls on a connected HubSpot account. It is a reference for what the integration accesses; subscribers or their MiSP do not call these endpoints directly. For the settings that establish the connection, see HubSpot Connections and Settings.

Endpoint areas: Contacts · Companies · Products · Orders · Order Line Items · Associations · Properties · Pipelines · Owners · Webhooks · Authorization · Pagination · Rate Limits

Portal Information

The integration does not require a portal or instance identifier in the endpoint path. HubSpot identifies the account from the access token presented on each request, so the same paths apply to every connected HubSpot account.

[Base URL] throughout this article is the value of the API Url subscription setting, which for HubSpot's public API is:

[Base URL] = https://api.hubapi.com

HubSpot does not publish separate staging and production hosts for the CRM API; the same host serves every account, and the account a call affects is determined by the credentials rather than by the URL.

The integration calls four HubSpot namespaces:

  • CRM v3: objects, properties, pipelines, and owners. This is the bulk of the integration's traffic.

  • CRM v4: association batch read and batch archive only.

  • Webhooks v3: event subscription and setting management.

  • OAuth v1: the token exchange described under Authorization Endpoint.

HubSpot introduced date-based API versioning (for example 2026-03) on March 30, 2026, and is migrating its documentation to that scheme. HubSpot states that the existing numbered versions continue to work during the transition, and that the support timeline for the v1–v3 APIs will be announced later. This integration calls the numbered v3 and v4 endpoints listed below.

Contacts

HubSpot Contacts carry the integration's Customer records.

Find contacts by last modified date (POST)

[Base URL]/crm/v3/objects/contacts/search

Used for polling and to locate a contact by id. The request body carries a filter on the lastmodifieddate property together with the page size and offset.

Get a contact with its associated companies and contacts (GET)

[Base URL]/crm/v3/objects/contacts/{contactId}?associations=Companies,Contacts

The associations query parameter is a comma-separated list of objects to retrieve associated record ids for.

Get contacts by a property value (POST)

[Base URL]/crm/v3/objects/contacts/batch/read

Used to resolve a contact from an email address.

Create a contact (POST)

[Base URL]/crm/v3/objects/contacts

Update a contact (PATCH)

[Base URL]/crm/v3/objects/contacts/{contactId}

Updates supply only the properties the mapping provides; properties that are not mapped are left as they are in HubSpot.

Get contact properties (GET)

[Base URL]/crm/v3/properties/contacts

Companies

Find companies by last modified date or domain (POST)

[Base URL]/crm/v3/objects/companies/search

Used for polling, to locate a company by id, and to find a company by its domain. Company polling filters on the hs_lastmodifieddate property.

Get a company with its associated companies and contacts (GET)

[Base URL]/crm/v3/objects/companies/{companyId}?associations=Companies,Contacts

Create a company (POST)

[Base URL]/crm/v3/objects/companies

Update a company (PATCH)

[Base URL]/crm/v3/objects/companies/{companyId}

Get company properties (GET)

[Base URL]/crm/v3/properties/companies

Products

Get a product (GET)

[Base URL]/crm/v3/objects/products/{productId}?properties=name,hs_sku,price

The properties query parameter is a comma-separated list of the properties to return. A requested property that is not defined in the account is simply omitted from the response.

Get products by a property value (POST)

[Base URL]/crm/v3/objects/products/batch/read

Used to resolve a product from a SKU.

Create a product (POST)

[Base URL]/crm/v3/objects/products

Update a product (PATCH)

[Base URL]/crm/v3/objects/products/{productId}

Get product properties (GET)

[Base URL]/crm/v3/properties/products

Orders

The integration's Transaction records map to the HubSpot Orders object, which HubSpot documents as a distinct CRM object for ecommerce purchases. Orders are not Deals, and the integration does not read or write the HubSpot Deals object.

Get an order (GET)

[Base URL]/crm/v3/objects/orders/{orderId}

Create an order (POST)

[Base URL]/crm/v3/objects/orders

Update an order (PATCH)

[Base URL]/crm/v3/objects/orders/{orderId}

Get order properties (GET)

[Base URL]/crm/v3/properties/orders

Order Line Items

Get a line item (GET)

[Base URL]/crm/v3/objects/line_items/{lineItemId}

Create a line item (POST)

[Base URL]/crm/v3/objects/line_items

Update a line item (PATCH)

[Base URL]/crm/v3/objects/line_items/{lineItemId}

Get line item properties (GET)

[Base URL]/crm/v3/properties/line_items

Associations

Associations are the links HubSpot keeps between records: a contact and its company, an order and the contact who placed it, an order and its line items. The integration uses them for customer and company relationships and to attach orders to their contacts, companies, and line items.

Each link carries an association type id that identifies the kind of relationship. HubSpot publishes the ids the integration relies on for orders: 507 for an order to a contact, 509 for an order to a company, and 513 for an order to a line item. Association type ids for other object pairs vary by account, because custom association labels create ids unique to that account.

Create an association between two records (PUT)

[Base URL]/crm/v3/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}/{associationTypeId}

Get a record's associations to another object (GET)

[Base URL]/crm/v3/objects/{objectType}/{objectId}/associations/{toObjectType}

Batch read contact associations (POST)

[Base URL]/crm/v4/associations/contacts/{toObjectType}/batch/read

Batch remove associations (POST)

[Base URL]/crm/v4/associations/{objectType}/{toObjectType}/batch/archive

Used when a transaction's link to a contact or company is removed.

Properties

HubSpot Properties are the fields on a CRM object. The integration reads them to resolve custom fields, and reads and writes them to synchronize customer and company categories.

HubSpot has no native contact or company category field. Categories are synchronized through a dropdown property that subscribers or their MiSP create in HubSpot and name in the Contact Category Field Name and Company Category Field Name subscription settings. If a category property is not created and named, category synchronization for that object is not performed. HubSpot Connections and Settings covers the property creation steps.

Get all properties for an object (GET)

[Base URL]/crm/v3/properties/{objectType}

Get a single property (GET)

[Base URL]/crm/v3/properties/{objectType}/{propertyName}

Used to read the category property named in the subscription settings, and its list of options.

Update the contact category property (PATCH)

[Base URL]/crm/v3/properties/contact/{propertyName}

Update the company category property (PATCH)

[Base URL]/crm/v3/properties/company/{propertyName}

Category transfers write the option list on the category property rather than creating a record. Subscribers or their MiSP should validate category behavior in a staging environment before relying on it in production.

Pipelines

Get the pipelines for an object (GET)

[Base URL]/crm/v3/pipelines/{objectType}

Returns each pipeline's id, label, and display order, along with when it was created or updated. The integration reads this to resolve pipeline and stage information for a record.

Owners

HubSpot Owners are the users a record can be assigned to.

Get an owner by email (GET)

[Base URL]/crm/v3/owners?email={emailAddress}

Get an owner by id (GET)

[Base URL]/crm/v3/owners/{ownerId}

HubSpot notes that the owner id is the value used when assigning ownership of a record.

Webhooks

Webhook subscriptions let HubSpot notify iPaaS.com when a record changes, which is what drives near-real-time inbound transfers. These endpoints manage the subscriptions themselves, not the event deliveries.

Webhook management is authenticated differently from every other call in this article. HubSpot documents these endpoints as authenticated with a developer API key supplied in the hapikey query string parameter, and they do not carry the OAuth bearer token used elsewhere. The {appId} in each path is the HubSpot public application id.

Get all webhook subscriptions (GET)

[Base URL]/webhooks/v3/{appId}/subscriptions?hapikey={developerApiKey}

Get a webhook subscription (GET)

[Base URL]/webhooks/v3/{appId}/subscriptions/{subscriptionId}?hapikey={developerApiKey}

Create a webhook subscription (POST)

[Base URL]/webhooks/v3/{appId}/subscriptions?hapikey={developerApiKey}

Update webhook subscription status in bulk (POST)

[Base URL]/webhooks/v3/{appId}/subscriptions/batch/update?hapikey={developerApiKey}

Get webhook settings (GET)

[Base URL]/webhooks/v3/{appId}/settings?hapikey={developerApiKey}

Update webhook settings (PUT)

[Base URL]/webhooks/v3/{appId}/settings?hapikey={developerApiKey}

Authorization Endpoint

The integration authenticates to HubSpot with the OAuth authorization code flow. Subscribers or their MiSP authorize the iPaaS.com application from the subscription settings, HubSpot returns an authorization code, and the integration exchanges that code for tokens.

Exchange an authorization code or refresh token for an access token (POST)

https://api.hubapi.com/oauth/v1/token

This is the one endpoint the API Url subscription setting does not govern. The token host is fixed at https://api.hubapi.com regardless of what API Url is set to.

The request is URL-form encoded and is sent in two situations:

  • Authorization code exchange: sends grant_type of authorization_code together with the client id, client secret, redirect URI, and the code HubSpot returned. HubSpot responds with an access_token, a refresh_token, and expires_in.

  • Token refresh: sends grant_type of refresh_token together with the client id, client secret, and the stored refresh_token. HubSpot responds with a new access token.

The client id, client secret, and redirect URI belong to the iPaaS.com HubSpot application and are configured on the iPaaS.com platform. They are not subscription settings, and subscribers or their MiSP do not supply them.

Every CRM, properties, pipelines, and owners call listed above presents the resulting token as a bearer token in the Authorization request header, in the form Authorization: Bearer {access_token}. The webhook endpoints are the exception, as described under Webhooks.

Pagination

Polling reads records from the search endpoints a page at a time. The integration requests a fixed page size of 100 records, starting at the beginning of the result set and advancing by 100 on each pass, and stops when a page comes back with no records. Subscribers or their MiSP do not configure the page size.

For reference, HubSpot documents its own search paging as follows:

  • Default page size: the search endpoints return pages of 10 records at a time unless a limit is supplied.

  • Maximum page size: HubSpot supports at most 200 objects per page.

  • Paging: HubSpot returns an after value in the paging.next.after property of each response, which a caller can pass on the next request to retrieve the following page.

HubSpot limits any single search query to 10,000 total results, so very large result sets are subject to the limits covered in the HubSpot Known Limitations article.

Rate Limits

HubSpot enforces its own published API rate limits on every call the integration makes. The limits below are HubSpot's, published for privately distributed apps:

HubSpot subscription tier

Burst limit (per 10 seconds)

Daily limit

Free and Starter

100 per app

250,000 per account

Professional

190 per app

625,000 per account

Enterprise

190 per app

1,000,000 per account

HubSpot also publishes these related limits:

  • API Limit Increase add-on: raises the burst limit to 250 per app and adds 1,000,000 calls per account per day on top of the base subscription, for each increase purchased. HubSpot allows a maximum of two.

  • Publicly distributed OAuth apps: each installed account is limited to 110 requests every 10 seconds, and the add-on does not raise this.

  • Search endpoints: rate limited separately to five requests per second per account.

  • Exceeding a limit: HubSpot responds with HTTP status 429 and an error type of RATE_LIMIT.

The integration does not retry or pause a transfer when HubSpot returns a rate limit response. A call that HubSpot rejects for exceeding a limit surfaces as an error in the iPaaS.com portal under DashboardIntegration MonitoringError Logs.

The controls subscribers or their MiSP can adjust are the throttling settings on the subscription. These are required, and the values are pre-populated by the integration; they should be reduced only if rate limit errors are encountered. For details, refer to Subscription Configuration – Edit.

Accounts running large transfers should stagger them rather than running several at once, and should validate throughput in a staging environment before a production cutover. For any rate limit error whose cause is not clear, Contact iPaaS.com Support.

Did this answer your question?