HubSpot

Overview
How to connect
Automated checks
Useful links

DSALTA connects to HubSpot using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.

Read-only access. DSALTA never modifies, creates, or deletes resources in your HubSpot environment.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads the HubSpot user roster — names, emails and roles, which appears on your Access page. HubSpot’s user settings API exposes no account status, so every member is listed as Active, and the only role signal it returns is a super-admin flag, so each row reads either Super Admin or User.It calls these HubSpot endpoints:

/settings/v3/users/?limit=1

Permissions the checks require: settings.users.readEvery request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your HubSpot environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the HubSpot card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from HubSpot. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

DSALTA requests these scopes: settings.users.read, settings.users.teams.read.HubSpot offers 2 ways to connect. Service Key is recommended.

Service Key (recommended)
Legacy App access token

Recommended. Create a HubSpot Service Key with user read scopes.Before you begin

Super Admin or Developer tools access permission in HubSpot

You will need:

Field	Where to find it	Example
Service Key	Development → Keys → Service Keys → Create service key. Scopes: settings.users.read, settings.users.teams.read. · Open	—

Start in DSALTA

Open Integrations in the DSALTA sidebar, find HubSpot, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Integrating HubSpot with DSALTA means

DSALTA will use your key to read HubSpot account users for security and compliance monitoring.

Create a Service Key

In HubSpot, go to Development → Keys → Service keys and click Create service key. Click Add new scope, tick settings.users.read (and settings.users.teams.read if you want the full set DSALTA requests), then save. Click Show next to the new key to reveal it, then Copy.

Account service keys are currently in public beta in HubSpot. If Keys → Service keys is not present in your portal, use the Legacy App access token method instead. HubSpot also recommends rotating service keys about every six months; rotation offers either immediate revocation or a 7-day grace period — use the grace period so DSALTA keeps syncing while you swap the key.

settings.users.read is the scope that actually matters — it is the only permission the two HubSpot checks declare and the only one the integration exercises. Ticking settings.users.teams.read as well is harmless but not required for anything DSALTA reads today.

Enter Service Key

Paste your key below and click Connect.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Invalid key or missing scopes. Ensure user read scopes are enabled.The on-screen message is generic — see Connection error messages.

Create a Legacy App under Development → Legacy Apps. Use when Service Keys are not available.Before you begin

Super Admin or permission to create Legacy Apps in Development

You will need:

Field	Where to find it	Example
Legacy App access token	Development → Legacy Apps → Create app → Scopes → Auth tab → Access token. · Open	`pat-na1-…`

Start in DSALTA

Integrating HubSpot with DSALTA means

DSALTA will use your access token to read HubSpot account users for security and compliance monitoring.

Create a Legacy App access token

In HubSpot, go to Development → Legacy apps → Create legacy app and choose Private. Fill in Basic info, open the Scopes tab, click Add new scope and tick settings.users.read (and settings.users.teams.read), then click Create app. Open the app’s Auth tab, click Show token and Copy — the token is shown only once.

You must be a HubSpot super admin to create a legacy (private) app, and the access token has one-time visibility — copy it from the Auth tab the moment it is shown, because you cannot retrieve it later.

Enter access token

Paste your token below and click Connect.

If the connection is rejected. Invalid token or missing scopes. Ensure user read scopes are enabled.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
User access to critical systems should be valid	Info	Checks that everyone with HubSpot access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active HubSpot access.

Topic	Link
Setup	HubSpot Service Keys (beta)
Setup	HubSpot private apps (Legacy Apps)
General	HubSpot website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting