Agent report card
Can an agent use HubSpot CRM API through API integration lifecycle?
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upReady
- PayLimited
- ProvisionLimited
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
The API overview publicly exposes stable entrypoints and endpoint patterns, such as GET /crm/objects/2026-03/contacts, under the root URL https://api.hubapi.com/.
Applicable terms are stable, readable, retrievable, and materially complete.
Eligibility conditions and required inputs are explicit and decidable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Verified structured artifacts accelerate discovery of the evaluation surface.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshEligibility conditions and required inputs are explicit and decidable.
The Developer Terms state that an individual representing an entity must have appropriate authority to accept the terms on behalf of the entity, be of legal age to form a binding contract, and not be prevented from using or receiving the Developer Tools under applicable laws.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
HubSpot explicitly declares that HubSpot's CRM is 100% free with no credit card required and no expiration date, providing clear no-charge pricing status before commitment.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The API overview publicly exposes stable entrypoints and endpoint patterns, such as GET /crm/objects/2026-03/contacts, under the root URL https://api.hubapi.com/.
Are verified structured discovery artifacts available?
supported: freshVerified structured artifacts accelerate discovery of the evaluation surface.
HubSpot explicitly provides a machine-readable structured documentation index located at /docs/llms.txt to discover available pages.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
Applicable legal terms, including the Customer Terms of Service and HubSpot Developer Terms, are readable, retrievable, and structured within HubSpot's Legal Center.
Does the vendor deliberately describe access for web agents?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence mentions /docs/llms.txt for discovery, but does not provide explicit robots.txt or web agent access policy rules for the assessed resources.
A stable canonical route begins the required access bootstrap.
A stable signup entry point to begin obtaining HubSpot service access is directly observed at the canonical URL.
Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained page displays 'Get started with HubSpot' but does not provide complete evidence of form fields, validation, navigation, or handoffs needed to establish access control operability.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
A stable signup entry point to begin obtaining HubSpot service access is directly observed at the canonical URL.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured evidence for the registration endpoint and CRM signup page contains no explicit declaration or direct observation regarding CAPTCHA requirements.
Can an agent obtain scoped, revocable authority for this service?
supported: freshScoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
HubSpot explicitly documents delegated identity access using OAuth, detailed query parameters, authorization URLs, redirect flows, and access/refresh token exchanges.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured evidence does not mention phone verification or SMS requirements.
The public commitment omits a material component until later in the flow.
HubSpot discloses the no-charge commitment for the free CRM before any authorization (100% free with no expiration date, no credit card required) and states that premium functionality is an upgrade; the charge, currency and recurrence of the paid tiers are not disclosed on the tested surfaces, so a material component of the paid commitment is deferred.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence describes an online upgrade process via a 'Buy now' button that leads to checkout, but does not provide documented API or protocol details establishing deterministic checkout construction, authorization handoff, and resumption.
Is the exact commercial commitment disclosed before authorization?
supported: freshThe public commitment omits a material component until later in the flow.
HubSpot discloses the no-charge commitment for the free CRM before any authorization (100% free with no expiration date, no credit card required) and states that premium functionality is an upgrade; the charge, currency and recurrence of the paid tiers are not disclosed on the tested surfaces, so a material component of the paid commitment is deferred.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The evidence notes that a credit card will be charged according to the billing period during the subscription term, but does not establish a documented rail for scoped delegation or explicit human-confirmed authorization with receipts.
Is a direct self-service path to paid access documented?
supported: freshA documented direct purchase path reaches paid access without a vendor decision point.
HubSpot documentation explicitly declares a direct self-service path to upgrade or purchase an individual subscription by clicking 'Buy now' and completing the on-screen checkout process right from the user's HubSpot account.
What would improve this stage
- Disclose the complete commitment before payment authorization.
Delivery needs additional human transfer or has weak scope or lifecycle semantics.
HubSpot OAuth tokens (access and refresh tokens) are delivered via an authorization code exchange request to /oauth/v3/token using the client ID and client secret.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshDelivery needs additional human transfer or has weak scope or lifecycle semantics.
HubSpot OAuth tokens (access and refresh tokens) are delivered via an authorization code exchange request to /oauth/v3/token using the client ID and client secret.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshA synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
Creating a CRM object synchronously returns a 201 response containing a usable created object copy, including its unique ID and properties.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
CRM object creation can be initiated programmatically via a POST request to /crm/v3/objects/{objectType}.
What would improve this stage
- Deliver scoped access material through a secure documented machine-usable flow.
Safe failure handling is documented only partially.
HubSpot documents status codes (such as 429 Rate limits and 5xx timeouts), retry recommendations (pausing for a few seconds), and JSON error object structure (message, code, context), but does not fully specify idempotency or cancellation semantics.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for HubSpot CRM API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets.
- crm-api
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
Private app access tokens can be rotated in the HubSpot UI under Legacy apps by clicking Rotate (either immediate rotation via 'Rotate and expire now' or scheduled via 'Rotate and expire later'), or revoked by deleting the app, but the rotation procedure is UI-based.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
HubSpot documents status codes (such as 429 Rate limits and 5xx timeouts), retry recommendations (pausing for a few seconds), and JSON error object structure (message, code, context), but does not fully specify idempotency or cancellation semantics.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
Requests to HubSpot API endpoints support scoped request-time authentication using an access token passed via the HTTP Authorization header as 'Bearer [YOUR_TOKEN]'.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
HubSpot API documentation defines REST endpoints, methods, parameters, JSON error structures, rate limit headers (such as X-HubSpot-RateLimit-Max), and detailed request/response schemas for CRM object operations.
- crm-api
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Documented HTTP REST API interfaces are available across all essential target documentation resources, allowing machine execution of operations via documented endpoints.
- crm-api
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
- Sign up: A stable canonical route begins the required access bootstrap.
What blocks agents
No stage is established as blocked.
Where autonomy is limited
- Pay: The public commitment omits a material component until later in the flow.
- Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
- Operate: Safe failure handling is documented only partially.
What this grade establishes
14 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.
How the grade is derived
A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.
Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.
Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.
Startup offers
HubSpot on the startup-offers board
- 90% off year 1, 50% off year 2, 25% off year 3HubSpot for Startups - Up to 90% Off
- 30% off year 1, 15% off year 2HubSpot for Startups - 30% Off
Distribution
The grade’s badge
One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.
[](https://sourcey.com/log/hubspot/agent-readiness/hubspot-crm-api/api-integration-lifecycle)Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4xa1m8yr7cf5q2b9vn6
- Projection
- sha256:1d244b7de425efc171a115db567d66d046020798b9c00a916be5eb1ae8fd77d2
- Policy
- service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration