Agent report card
Can an agent use HubSpot CRM API through API integration lifecycle?
Grade B+: Safe failure handling is documented only partially.
HubSpot / active
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upReady
- PayReady
- ProvisionReady
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
Applicable terms are stable, readable, retrievable, and materially complete.
Eligibility conditions and required inputs are explicit and decidable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshEligibility conditions and required inputs are explicit and decidable.
HubSpot's Developer Terms explicitly define eligibility and authority requirements for using Developer Tools, including authority to accept terms on behalf of an entity, legal age capacity, compliance with platform policies, and not being barred by applicable laws.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
HubSpot explicitly declares that its CRM product is 100% free with no expiration date and no credit card required.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
HubSpot provides stable public discovery for its date-versioned 2026-03 API endpoints using the root URL https://api.hubapi.com/ and structured resource paths such as GET /crm/objects/2026-03/contacts.
Are verified structured discovery artifacts available?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
HubSpot provides retrievable, readable, and publicly accessible Customer Terms of Service and Developer Terms outlining the governing agreements for customer and developer service use.
Does the vendor deliberately describe access for web agents?
missing: unknownCurrent admissible evidence does not resolve this finding.
A stable canonical route begins the required access bootstrap.
Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained page fragment for the CRM signup endpoint displays 'Get started with HubSpot' without providing detectable access controls, form fields, validation logic, or redirect handoffs.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
A stable canonical route to begin obtaining service access exists at https://app.hubspot.com/signup-hubspot/crm, presenting the 'Get started with HubSpot' entrypoint.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured evidence across both evaluated surfaces shows 'Get started with HubSpot' but contains no explicit text or rendered CAPTCHA challenge confirming its presence or absence.
Can an agent obtain scoped, revocable authority for this service?
supported: freshScoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
HubSpot explicitly documents delegated OAuth authentication via authorization URLs, redirect_uri callback, and an API exchange at /oauth/v3/token to obtain access_token and refresh_token scoped to requested permissions.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence for the CRM signup resource does not mention phone verification or SMS requirements.
Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
While documentation references clicking Buy now to begin checkout and managing subscriptions in account settings, the retained evidence does not document deterministic checkout construction, approval handoff, and resumption.
Is the exact commercial commitment disclosed before authorization?
supported: freshCharge or no-charge status, currency, recurrence, and material conditions are disclosed.
The assessed free CRM is explicitly 100% free, requires no credit card, and has no expiration date.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The evidence requires Billing admin permissions to make billing changes and mentions credit card charges during subscription terms, but does not document a delegated payment authorization rail or explicit human-confirmed authorization with receipts.
Is a direct self-service path to paid access documented?
supported: freshA documented direct purchase path reaches paid access without a vendor decision point.
Documentation explicitly states that users can visit Pricing & Features in their account, click Buy now to begin checkout, and complete a purchase to upgrade their subscription directly.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
Credentials, grants, or configuration are delivered through a documented agent-usable flow.
A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshCredentials, grants, or configuration are delivered through a documented agent-usable flow.
HubSpot OAuth tokens are delivered through a documented programmatic exchange endpoint (`/oauth/v3/token`), which returns an `access_token` and `refresh_token` after exchanging the authorization code.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshA synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
A synchronous POST request to create a CRM object directly returns HTTP status code 201 with the created public object, including its unique ID, timestamps (createdAt, updatedAt), and property key-value pairs.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Provisioning of CRM objects is triggerable programmatically via a direct POST request to /crm/v3/objects/{objectType}. Additionally, OAuth app installation follows deterministically from user access authorization.
Safe failure handling is documented only partially.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
HubSpot documents that access tokens can be refreshed using a refresh token when expired, and private app access tokens can be rotated (either immediately or scheduled for 7 days) or revoked by deleting the app, but recovery or full agent-executable lifecycle without human intervention is not established.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
HubSpot documents rate limit errors (429), timeouts (502/504), service temporary errors (503), SSL issues (525/526), and retry guidance including Retry-After headers, but full idempotency, cancellation, and reconciliation semantics are not completely established.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
HubSpot documents request-time authentication using Bearer access tokens generated via OAuth or private apps with scope-restricted permissions.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
HubSpot documents stable operational contracts, endpoints, request schemas, parameters, and response structures across error handling, usage guidelines, date-versioned API reference overview, and CRM object creation operations.
- crm-api
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
HubSpot provides machine-operable HTTP API endpoints across error handling, platform usage limits, date-versioned API overview, and CRM object creation operations.
- crm-api
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
- Sign up: A stable canonical route begins the required access bootstrap.
- Pay: Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
- Provision: Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
What blocks agents
- Operate: Safe failure handling is documented only partially.
Startup offers
HubSpot on the startup-offers board
- 90% off year 1, 50% off year 2, 25% off year 3HubSpot for Startups - Up to 90% Off
- 30% off year 1, 15% off year 2HubSpot for Startups - 30% Off
Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4xa1m8yr7cf5q2b9vn6
- Projection
- sha256:84d418ca7f69282903be7bc9169615e2e84d9c809e83c5626f3d702ada104859
- Policy
- service-use-2026-08-20-public-evidence-r9 · sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration