{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyh8fpe3new9gxd18qs3bskh", "entity_slug": "hubspot", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xa1m8yr7cf5q2b9vn6", "entity_id": "ent_01kyh8fpe3new9gxd18qs3bskh", "scope": { "product": { "key": "hubspot-crm-api", "name": "HubSpot CRM API" }, "funnel": { "key": "api-integration-lifecycle", "name": "API integration lifecycle" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:d834f446f341ff50dd565416a3b8489b405fe189c597bcfa66ca67249314dd03" }, "declaration_revision_digest": "sha256:2538ff7b69270e0b651ecd3add7601bd2e6619766e25ce9b137579cdd014d881", "declaration": { "declaration_id": "declaration_hubspot_crm_api_integration_lifecycle", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/hu/hubspot.yaml", "git_blob_oid": "55ec5a2192e3611b222bbd521a5774de964c89a2", "blob_digest": "sha256:cd8e9d116ae09a6eee1599fd1e1b8cba958666ee64d25436c5a7495fe2a98e2f" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and manage HubSpot CRM records through the API", "interface_ids": [ "crm-api" ] } ], "participants": [ { "participant_id": "hubspot", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe3new9gxd18qs3bskh" } } ], "resources": [ { "resource_id": "api-errors", "uri": "https://developers.hubspot.com/docs/api-reference/error-handling", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "api-limits", "uri": "https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "api-overview", "uri": "https://developers.hubspot.com/docs/api-reference/overview", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "billing-checkout", "uri": "https://knowledge.hubspot.com/account/manage-your-hubspot-subscription", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "crm-commitment", "uri": "https://www.hubspot.com/products/crm", "roles": [ "documentation", "pricing" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "crm-operations", "uri": "https://developers.hubspot.com/docs/api-reference/legacy/crm/objects/objects/create-object", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "crm-signup", "uri": "https://app.hubspot.com/signup-hubspot/crm", "roles": [ "access" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "oauth", "uri": "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/oauth/working-with-oauth", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "hubspot", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "describes" } ] }, { "resource_id": "pricing", "uri": "https://www.hubspot.com/pricing/crm", "roles": [ "pricing" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "readiness-237735cc5ba6ecc44afc3287e10b76ffb4c73481fb6a5a1f2ca6e1fa98a8ee41", "uri": "https://legal.hubspot.com/developer-terms", "roles": [ "documentation", "eligibility" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c", "uri": "https://developers.hubspot.com/docs/api/private-apps", "roles": [ "authentication", "documentation" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "readiness-fedf565215bcde83431a45666a9a0edc7be9032ca5dbd43956ab753094c89a09", "uri": "https://legal.hubspot.com/terms-of-service", "roles": [ "documentation", "terms" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://legal.hubspot.com/legal-stuff", "roles": [ "terms" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "subscription-upgrade", "uri": "https://knowledge.hubspot.com/account-management/how-do-i-upgrade-my-hubspot-account", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://knowledge.hubspot.com/", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "hubspot-api", "uri": "https://api.hubapi.com", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "endpoint_id": "oauth-token", "uri": "https://api.hubapi.com/oauth/v1/token", "transport": "http", "roles": [ "authorization", "token" ], "operated_by_participant_id": "hubspot", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "implements" } ] }, { "endpoint_id": "registration", "uri": "https://app.hubspot.com/signup-hubspot/crm", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "crm-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "hubspot-api" ], "resource_ids": [ "api-errors", "api-limits", "api-overview", "crm-operations" ], "operated_by_participant_id": "hubspot", "standard_bindings": [] }, { "interface_id": "integration-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [ "oauth-token" ], "resource_ids": [ "oauth" ], "operated_by_participant_id": "hubspot", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "uses" } ] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "integration-authentication" }, "to": { "node_kind": "interface", "node_id": "crm-api" } }, { "relation_id": "crm-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "crm-operations" }, "to": { "node_kind": "interface", "node_id": "crm-api" } }, { "relation_id": "overview-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-overview" }, "to": { "node_kind": "interface", "node_id": "crm-api" } }, { "relation_id": "relation-describes-091810ae56e2e84f96a64120fd2a5ad4b8bc336eb4c3abbdcaca07a2bd23c18a", "kind": "describes", "from": { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" }, "to": { "node_kind": "interface", "node_id": "integration-authentication" } }, { "relation_id": "relation-describes-b393d1b40a6a6b010018783b7b2272f9b811ed8dc1f6da3d7422cb2cec3f8fb7", "kind": "describes", "from": { "node_kind": "resource", "node_id": "oauth" }, "to": { "node_kind": "interface", "node_id": "integration-authentication" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "crm-signup" }, "to": { "node_kind": "interface", "node_id": "integration-authentication" } } ], "surface_exclusions": [] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:2f3b49ebdee173ea1951147656ae676c691fcbc22b55a64c29ae92d2c18fbb23", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "B", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "pay", "stage_label": "Pay", "public_state": "limited", "finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "HubSpot discloses the no-charge commitment for the free CRM before any authorization (100% free with no expiration date, no credit card required) and states that premium functionality is an upgrade; the charge, currency and recurrence of the paid tiers are not disclosed on the tested surfaces, so a material component of the paid commitment is deferred." } }, "limitations": [ { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "HubSpot discloses the no-charge commitment for the free CRM before any authorization (100% free with no expiration date, no credit card required) and states that premium functionality is an upgrade; the charge, currency and recurrence of the paid tiers are not disclosed on the tested surfaces, so a material component of the paid commitment is deferred." }, "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "HubSpot OAuth tokens (access and refresh tokens) are delivered via an authorization code exchange request to /oauth/v3/token using the client ID and client secret." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "HubSpot documents status codes (such as 429 Rate limits and 5xx timeouts), retry recommendations (pausing for a few seconds), and JSON error object structure (message, code, context), but does not fully specify idempotency or cancellation semantics." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Private app access tokens can be rotated in the HubSpot UI under Legacy apps by clicking Rotate (either immediate rotation via 'Rotate and expire now' or scheduled via 'Rotate and expire later'), or revoked by deleting the app, but the rotation procedure is UI-based." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The API overview publicly exposes stable entrypoints and endpoint patterns, such as GET /crm/objects/2026-03/contacts, under the root URL https://api.hubapi.com/." }, "secondary_context": [ { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence mentions /docs/llms.txt for discovery, but does not provide explicit robots.txt or web agent access policy rules for the assessed resources." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "Applicable legal terms, including the Customer Terms of Service and HubSpot Developer Terms, are readable, retrievable, and structured within HubSpot's Legal Center." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "The Developer Terms state that an individual representing an entity must have appropriate authority to accept the terms on behalf of the entity, be of legal age to form a binding contract, and not be prevented from using or receiving the Developer Tools under applicable laws." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "HubSpot explicitly declares that HubSpot's CRM is 100% free with no credit card required and no expiration date, providing clear no-charge pricing status before commitment." }, { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "context": "HubSpot explicitly provides a machine-readable structured documentation index located at /docs/llms.txt to discover available pages." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:54.788Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "readiness-237735cc5ba6ecc44afc3287e10b76ffb4c73481fb6a5a1f2ca6e1fa98a8ee41" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f4fcebfb20578d2110bf4e34acd5553752daa94cab890f80d6a85109d3c21978", "capture_rung": "http" } ], "artifact_digests": [ "sha256:64a37c9326b044f11a34fc930ff5b9786e5e0ace669abee6907492384863f4db", "sha256:7db22c6e2df73a618ca8347b6565646dec559b2650829d79218411fbca60a8e8", "sha256:e9bcd942a0945a46b606712beecfea8b3d9b6e691010a5e7e4e4637247d7d66d", "sha256:f4d90baf96764232a3f29a2fe5c70ab1d1dfd922e5a3e9682d6088d0b3f571ec" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-237735cc5ba6ecc44afc3287e10b76ffb4c73481fb6a5a1f2ca6e1fa98a8ee41" }, "locators": [ { "artifact_digest": "sha256:f4d90baf96764232a3f29a2fe5c70ab1d1dfd922e5a3e9682d6088d0b3f571ec", "start_byte": 20607, "end_byte": 21415, "value_digest": "sha256:6053b30b7f5644557b47aedaf40450c9c1452978e8052c2a3e2371204456598b" } ] } ], "note": "The Developer Terms state that an individual representing an entity must have appropriate authority to accept the terms on behalf of the entity, be of legal age to form a binding contract, and not be prevented from using or receiving the Developer Tools under applicable laws." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:52:22.641Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "crm-commitment" }, { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9af747dba6b0a6a632883ad74b12c442e17130d3454d8d8dd6475d9685846423", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:173e496512fa87a833e9935a20cdddf96ef17770b56efa79b9bd933e9d7ef345", "sha256:1ff6b7762a8bae9a99ee9a77e6a2dc3624a59188323b019c40716c4664f20bdf", "sha256:3878570f4a62a0d65f57cf1754e0269e56ec797f4e36e26b44c172eb6e800401", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6d71c44a4fdccb0b26d0e0b1d69b06751677f232137111782c6d6362e9c67913", "sha256:bf3c0d695fd07c6ca799a0412971ebe9d1e7aa55554fd5134d6a7d267954b138" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:1ff6b7762a8bae9a99ee9a77e6a2dc3624a59188323b019c40716c4664f20bdf", "start_byte": 0, "end_byte": 796, "value_digest": "sha256:0347e27d309bc7222defc72b4b18f0d66d7993b921b8f8275dae3cc4f6726e70" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6976a0b8e956c7106066b462a893d9966b76fc40eb711408eb582e99a5b05d03", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6e39a3979a5f196cb4794a3898fbe7597f5164044c62efea918aabf6388f7ed1", "sha256:dd9882504630822d904e3e5e81cd89194dc1db6acaf75d140185b630a32c4191", "sha256:f3bfa21cb5860c14d396ce08f20a2128d9b31860ffe1c4eb3a9aa88d0026ecef" ], "source_surface": { "node_kind": "resource", "node_id": "crm-commitment" }, "locators": [ { "artifact_digest": "sha256:dd9882504630822d904e3e5e81cd89194dc1db6acaf75d140185b630a32c4191", "start_byte": 29327, "end_byte": 30129, "value_digest": "sha256:43da9dbff6076010b8a8e63aa4a681d0b0f8108edb06cb723a3f72133a9eb76e" } ] } ], "note": "HubSpot explicitly declares that HubSpot's CRM is 100% free with no credit card required and no expiration date, providing clear no-charge pricing status before commitment." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:05.662Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-overview" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:455abedca7a40ea9c4389671a9fb1668fa3262904926893b7cd22f5bfdf507c9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5cdace01395b6c44bb4cbae7421cff5fdedc6a0424d6d6a6e612787b93a2cee8", "sha256:62b090664baddee217f0ee6cb396d836067021a2d06fda285d27439dc5ef620b", "sha256:7a84c1d0c588ba670ed0cb116985a03916a33dbace96e926deaec65368794651", "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3" ], "locators": [ { "artifact_digest": "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3", "start_byte": 3970, "end_byte": 4774, "value_digest": "sha256:d8ccbdc4975b479689984c2d9a6d6b7001654f4367426f1cd1319ecdcc07dbb1" } ] } ], "note": "The API overview publicly exposes stable entrypoints and endpoint patterns, such as GET /crm/objects/2026-03/contacts, under the root URL https://api.hubapi.com/." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are verified structured discovery artifacts available?", "finding": "Verified structured artifacts accelerate discovery of the evaluation surface.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:05.662Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-overview" }, { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:455abedca7a40ea9c4389671a9fb1668fa3262904926893b7cd22f5bfdf507c9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5cdace01395b6c44bb4cbae7421cff5fdedc6a0424d6d6a6e612787b93a2cee8", "sha256:62b090664baddee217f0ee6cb396d836067021a2d06fda285d27439dc5ef620b", "sha256:7a84c1d0c588ba670ed0cb116985a03916a33dbace96e926deaec65368794651", "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3" ], "locators": [ { "artifact_digest": "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3", "start_byte": 3970, "end_byte": 4774, "value_digest": "sha256:d8ccbdc4975b479689984c2d9a6d6b7001654f4367426f1cd1319ecdcc07dbb1" } ] } ], "note": "HubSpot explicitly provides a machine-readable structured documentation index located at /docs/llms.txt to discover available pages." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:08.842Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "readiness-fedf565215bcde83431a45666a9a0edc7be9032ca5dbd43956ab753094c89a09" }, { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d5f9e4177b60fd315d00feac9b814d8dfdae26892a7b40c0e8ec7ff3479b9ba7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:119f8508e6e418f4880bb646eafce7b18a802da8be724d949fb43033f744aa06", "sha256:1aa9ab5f353ba00bccb36bbf0aa711d3af9e439185927131abb38e359d6fbe05", "sha256:776a9ad7c502be5b4333c74d38ddb85481b20bd5a2ad7cd33f24def2cd7bf385", "sha256:94fd146d8c4898b5be660458c89e9a82a94670c88822f33e434f37e12545bb75" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:94fd146d8c4898b5be660458c89e9a82a94670c88822f33e434f37e12545bb75", "start_byte": 19664, "end_byte": 20462, "value_digest": "sha256:44df1a28ddf6333d3e07e29bc90a89eb9e9128352d2625fb13bcea2686eb0d05" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1aeac83940a709dbae5a5a0f36a1259bff20a6b67c2a5969a97deb2c85bfabf5", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3782b3c86133d8ab70cb7636c7ab048739362fa5993581ed501e4c58dac748a7", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a74c216c33bc095a7a5fffdc378d2262029c6bec827502e9c52dfef644ef2926", "sha256:c49c0fc7af6fe1f1b7ca5462b28a4abdf41561e1d337ec8d50cf8755bd8555c3" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-fedf565215bcde83431a45666a9a0edc7be9032ca5dbd43956ab753094c89a09" }, "locators": [ { "artifact_digest": "sha256:a74c216c33bc095a7a5fffdc378d2262029c6bec827502e9c52dfef644ef2926", "start_byte": 15042, "end_byte": 15843, "value_digest": "sha256:9fd8f76fcab037ca2f5e853ae566fdcdff92369ee61eca972dbcb517b239c891" } ] } ], "note": "Applicable legal terms, including the Customer Terms of Service and HubSpot Developer Terms, are readable, retrievable, and structured within HubSpot's Legal Center." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:05.662Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-overview" }, { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence mentions /docs/llms.txt for discovery, but does not provide explicit robots.txt or web agent access policy rules for the assessed resources." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "A stable signup entry point to begin obtaining HubSpot service access is directly observed at the canonical URL." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained page displays 'Get started with HubSpot' but does not provide complete evidence of form fields, validation, navigation, or handoffs needed to establish access control operability." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured evidence for the registration endpoint and CRM signup page contains no explicit declaration or direct observation regarding CAPTCHA requirements." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured evidence does not mention phone verification or SMS requirements." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "HubSpot explicitly documents delegated identity access using OAuth, detailed query parameters, authorization URLs, redirect flows, and access/refresh token exchanges." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:20.125Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained page displays 'Get started with HubSpot' but does not provide complete evidence of form fields, validation, navigation, or handoffs needed to establish access control operability." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:20.125Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "crm-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:4d7717c15d90b8902118888ecb756fc32a4e69c10352b08752d3fd53f5668a3e", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:3186256e939318e87a90f6620216137c75a3a70ef00deb091f8b307d4ac1bbe9", "sha256:3878570f4a62a0d65f57cf1754e0269e56ec797f4e36e26b44c172eb6e800401", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b2c39630be1dec5a038a99af71ee93298399ef2df8ce557bf590a44c910b82cb", "sha256:b7d3ab371115bb130152828efacd7b8b39daa06516dc15991fd1dc194dd523a5", "sha256:c4c643d6f75b2ac2f863d0385d4007236bd9fbebb500cd58a97d305d5a002042" ], "locators": [ { "artifact_digest": "sha256:b2c39630be1dec5a038a99af71ee93298399ef2df8ce557bf590a44c910b82cb", "start_byte": 303, "end_byte": 337, "value_digest": "sha256:a43aea4e70ffbd2578366bd4c5e24ac6c4529d30065d12322d84d1f932cbefd6" } ] } ], "note": "A stable signup entry point to begin obtaining HubSpot service access is directly observed at the canonical URL." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:20.125Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "crm-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The captured evidence for the registration endpoint and CRM signup page contains no explicit declaration or direct observation regarding CAPTCHA requirements." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:52.529Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" }, { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:70bef1e17d38f0c992d1f80f006007b9fbe837e961e375d23c259e3ef7316f0d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0b49ff43e213d509c1026a58e49413a0672bda5aa3a895e4601f656dd06ddef9", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:634e493fa2444dccfa8f51870ff0caf5c723c92eed5575816f550e3080a9fb7e", "sha256:b5a8a3a8c4a8bf13348eb0c183f168f50870bd9d685b864d8f8ee2b70ca098e1" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:b5a8a3a8c4a8bf13348eb0c183f168f50870bd9d685b864d8f8ee2b70ca098e1", "start_byte": 0, "end_byte": 590, "value_digest": "sha256:6cdd35ffb1b88eb841b3c61de9e07ec4519ae7906f1f90e2dba1aff66791c32f" }, { "artifact_digest": "sha256:b5a8a3a8c4a8bf13348eb0c183f168f50870bd9d685b864d8f8ee2b70ca098e1", "start_byte": 9170, "end_byte": 9962, "value_digest": "sha256:c2cf9661a9ebeb4f5ee59a9b0b35fce1f0636af723d6c49bbdf8308804f20048" } ] } ], "note": "HubSpot explicitly documents delegated identity access using OAuth, detailed query parameters, authorization URLs, redirect flows, and access/refresh token exchanges." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:20.125Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "crm-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The captured evidence does not mention phone verification or SMS requirements." } ], "blockers": [], "remediations": [] }, { "stage": "pay", "stage_label": "Pay", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "HubSpot discloses the no-charge commitment for the free CRM before any authorization (100% free with no expiration date, no credit card required) and states that premium functionality is an upgrade; the charge, currency and recurrence of the paid tiers are not disclosed on the tested surfaces, so a material component of the paid commitment is deferred." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence describes an online upgrade process via a 'Buy now' button that leads to checkout, but does not provide documented API or protocol details establishing deterministic checkout construction, authorization handoff, and resumption." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The evidence notes that a credit card will be charged according to the billing period during the subscription term, but does not establish a documented rail for scoped delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "HubSpot documentation explicitly declares a direct self-service path to upgrade or purchase an individual subscription by clicking 'Buy now' and completing the on-screen checkout process right from the user's HubSpot account." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:38.759Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "subscription-upgrade" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence describes an online upgrade process via a 'Buy now' button that leads to checkout, but does not provide documented API or protocol details establishing deterministic checkout construction, authorization handoff, and resumption." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.481Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "crm-commitment" }, { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6976a0b8e956c7106066b462a893d9966b76fc40eb711408eb582e99a5b05d03", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5e4721cc8b093d0bc3d0243e2d075cc8ce31936ec5ab9d52d63e55af73339e3a", "sha256:dd9882504630822d904e3e5e81cd89194dc1db6acaf75d140185b630a32c4191", "sha256:f3bfa21cb5860c14d396ce08f20a2128d9b31860ffe1c4eb3a9aa88d0026ecef" ], "source_surface": { "node_kind": "resource", "node_id": "crm-commitment" }, "locators": [ { "artifact_digest": "sha256:dd9882504630822d904e3e5e81cd89194dc1db6acaf75d140185b630a32c4191", "start_byte": 29383, "end_byte": 29594, "value_digest": "sha256:f6b4c14ede33cd3bd1a2bcc7f9a6dee4131b8051f23b3e3942f53340202d952c" }, { "artifact_digest": "sha256:dd9882504630822d904e3e5e81cd89194dc1db6acaf75d140185b630a32c4191", "start_byte": 29941, "end_byte": 30096, "value_digest": "sha256:0f522b5a4896e13eff181a1f25c2687da5442a5698496711bc8d02d9f55e2111" } ] } ], "note": "HubSpot discloses the no-charge commitment for the free CRM before any authorization (100% free with no expiration date, no credit card required) and states that premium functionality is an upgrade; the charge, currency and recurrence of the paid tiers are not disclosed on the tested surfaces, so a material component of the paid commitment is deferred.", "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:38.759Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "subscription-upgrade" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The evidence notes that a credit card will be charged according to the billing period during the subscription term, but does not establish a documented rail for scoped delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:38.759Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "billing-checkout" }, { "node_kind": "resource", "node_id": "subscription-upgrade" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1e6042fb13bd07bbd1153ae0fbce0696b90792ffc9592d796360788edf85b20f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5602a5949518b1baf67c6c547821201a460bd253b499ee2d02fe5481735026d0", "sha256:6c663df4cbf5a98dea52f1830ae396d188af13738fd12ed33eea0a4cfceb4f1d", "sha256:7c824e2daee90901692a86a13940629f7094798bd91b477c2a81eab4a1eec665" ], "source_surface": { "node_kind": "resource", "node_id": "subscription-upgrade" }, "locators": [ { "artifact_digest": "sha256:5602a5949518b1baf67c6c547821201a460bd253b499ee2d02fe5481735026d0", "start_byte": 8574, "end_byte": 9364, "value_digest": "sha256:f0fb122626ecad0dd12bdd314999c268ded69c1217dfc61307c9829639af4ffa" } ] } ], "note": "HubSpot documentation explicitly declares a direct self-service path to upgrade or purchase an individual subscription by clicking 'Buy now' and completing the on-screen checkout process right from the user's HubSpot account." } ], "blockers": [], "remediations": [ { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "HubSpot OAuth tokens (access and refresh tokens) are delivered via an authorization code exchange request to /oauth/v3/token using the client ID and client secret." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "CRM object creation can be initiated programmatically via a POST request to /crm/v3/objects/{objectType}." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "Creating a CRM object synchronously returns a 201 response containing a usable created object copy, including its unique ID and properties." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:52.529Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" }, { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:70bef1e17d38f0c992d1f80f006007b9fbe837e961e375d23c259e3ef7316f0d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0b49ff43e213d509c1026a58e49413a0672bda5aa3a895e4601f656dd06ddef9", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9febdd2e7dc71ec8057e2537296b256903037ddf366a118f41b0240584e97906", "sha256:b5a8a3a8c4a8bf13348eb0c183f168f50870bd9d685b864d8f8ee2b70ca098e1" ], "source_surface": { "node_kind": "resource", "node_id": "oauth" }, "locators": [ { "artifact_digest": "sha256:b5a8a3a8c4a8bf13348eb0c183f168f50870bd9d685b864d8f8ee2b70ca098e1", "start_byte": 8370, "end_byte": 9169, "value_digest": "sha256:c14641ad7b925d7a59c570c7345ef8561353d22a1876a00ee5aa8996c095014d" }, { "artifact_digest": "sha256:b5a8a3a8c4a8bf13348eb0c183f168f50870bd9d685b864d8f8ee2b70ca098e1", "start_byte": 9170, "end_byte": 9962, "value_digest": "sha256:c2cf9661a9ebeb4f5ee59a9b0b35fce1f0636af723d6c49bbdf8308804f20048" } ] } ], "note": "HubSpot OAuth tokens (access and refresh tokens) are delivered via an authorization code exchange request to /oauth/v3/token using the client ID and client secret.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:32.728Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "crm-operations" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:51f922c47089a2d9d66a1749515c728607a78b4fe8520e7e3b696645ab781214", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6f3869c49ccbda0740226c732aabaad4c32ac018b5a2a7d9150f0e522ea8a193", "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "sha256:f1746c69c5dee859873c94472bb87b19ae9bdbcccabbb4a3af79618e01805005" ], "source_surface": { "node_kind": "resource", "node_id": "crm-operations" }, "locators": [ { "artifact_digest": "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "start_byte": 15164, "end_byte": 15977, "value_digest": "sha256:f36b7933ec2251b2966945bcca313d317a5709c50e30516da7bfb31530186eb7" }, { "artifact_digest": "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "start_byte": 8373, "end_byte": 9173, "value_digest": "sha256:24133138d75db762d8a551b8c4d358ebf7bf9d5344204d20d12dc5f31e3808cf" } ] } ], "note": "Creating a CRM object synchronously returns a 201 response containing a usable created object copy, including its unique ID and properties." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:32.728Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "crm-operations" }, { "node_kind": "resource", "node_id": "oauth" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:51f922c47089a2d9d66a1749515c728607a78b4fe8520e7e3b696645ab781214", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3436751780df7bf220db8be2a6fcb88f409cfaf97a2ad5fa3b3c98fb166da51c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "sha256:f1746c69c5dee859873c94472bb87b19ae9bdbcccabbb4a3af79618e01805005" ], "source_surface": { "node_kind": "resource", "node_id": "crm-operations" }, "locators": [ { "artifact_digest": "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "start_byte": 5175, "end_byte": 5979, "value_digest": "sha256:100ba0cae74e6f56c8f00c3c9a219c7443fb2620260b68a7b5c21a0b680261ae" }, { "artifact_digest": "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "start_byte": 9174, "end_byte": 9959, "value_digest": "sha256:627552140b273c89f019f9071fe739f28d3f52c2af5076b6ac6b5bc90210b44c" } ] } ], "note": "CRM object creation can be initiated programmatically via a POST request to /crm/v3/objects/{objectType}." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "HubSpot documents status codes (such as 429 Rate limits and 5xx timeouts), retry recommendations (pausing for a few seconds), and JSON error object structure (message, code, context), but does not fully specify idempotency or cancellation semantics." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for HubSpot CRM API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Private app access tokens can be rotated in the HubSpot UI under Legacy apps by clicking Rotate (either immediate rotation via 'Rotate and expire now' or scheduled via 'Rotate and expire later'), or revoked by deleting the app, but the rotation procedure is UI-based." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Documented HTTP REST API interfaces are available across all essential target documentation resources, allowing machine execution of operations via documented endpoints." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Requests to HubSpot API endpoints support scoped request-time authentication using an access token passed via the HTTP Authorization header as 'Bearer [YOUR_TOKEN]'." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "HubSpot API documentation defines REST endpoints, methods, parameters, JSON error structures, rate limit headers (such as X-HubSpot-RateLimit-Max), and detailed request/response schemas for CRM object operations." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:05.662Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "crm-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for HubSpot CRM API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:59.751Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" }, { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:95d710318ce067a3bc073fcc58e69f9f22f76c2cf749daa2fc5477614fa885e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:60b1f4833cf9d9ee751c1fdb41e46f5ca8c41531279fe0b18a40f98833aa1097", "sha256:cc609a6b00edc7cdea917e19b1ef0ee97eabdd1b10fde1d4e500a87903f30a4e", "sha256:e6795254b882d12553f2e5df9c22a38dcfeaa549dfa334ff716a0860303e6a8e", "sha256:e691779bd0bfb8943d3b0da54bf70516a0a2e7f1d4fb6830eb0f71f466920d62" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" }, "locators": [ { "artifact_digest": "sha256:e6795254b882d12553f2e5df9c22a38dcfeaa549dfa334ff716a0860303e6a8e", "start_byte": 11526, "end_byte": 12328, "value_digest": "sha256:dc400a997bd8dd8fabffd993daaf96cf4f041dce2664fbee391d56fb2bafdc9a" }, { "artifact_digest": "sha256:e6795254b882d12553f2e5df9c22a38dcfeaa549dfa334ff716a0860303e6a8e", "start_byte": 12329, "end_byte": 13132, "value_digest": "sha256:b2b4ef971e343fa2d2f2f397f219e0e8ae4675405edf22b489cb21266e0a62e0" } ] } ], "note": "Private app access tokens can be rotated in the HubSpot UI under Legacy apps by clicking Rotate (either immediate rotation via 'Rotate and expire now' or scheduled via 'Rotate and expire later'), or revoked by deleting the app, but the rotation procedure is UI-based.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:40.067Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-errors" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c81368126aa9d750904ca32c7c900dfd2100f16e7304e77a0b2967cf06fc0eb0", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "sha256:a018ce10fa94570ca2a05658f326a5df113e92df2d46e24f62dab19a7ea7a788", "sha256:c3bfd1ad4ea879ae3ca780903b4181d568511f542c1fc9e4f35ef318a7341952" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "start_byte": 9430, "end_byte": 10214, "value_digest": "sha256:630516a42a425fb9057ae7ba06f07249f0cd7f8c08af75a51548e7f1c13d7e37" }, { "artifact_digest": "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "start_byte": 7024, "end_byte": 7823, "value_digest": "sha256:7a3ab3877c6dcda57eceffd69d4208e271d12028d68fe6b1e22f553386b9e6bb" } ] } ], "note": "HubSpot documents status codes (such as 429 Rate limits and 5xx timeouts), retry recommendations (pausing for a few seconds), and JSON error object structure (message, code, context), but does not fully specify idempotency or cancellation semantics.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:59.751Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "oauth" }, { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:95d710318ce067a3bc073fcc58e69f9f22f76c2cf749daa2fc5477614fa885e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:60b1f4833cf9d9ee751c1fdb41e46f5ca8c41531279fe0b18a40f98833aa1097", "sha256:cad04c9bc69687d37165088e2c371f8feb5ddcc1af4788dba443590e76828ed6", "sha256:cc609a6b00edc7cdea917e19b1ef0ee97eabdd1b10fde1d4e500a87903f30a4e", "sha256:e6795254b882d12553f2e5df9c22a38dcfeaa549dfa334ff716a0860303e6a8e" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-ae84fdbaa51b9b88febbd2301b4157e03f052892fed3e42d69d878696fe3944c" }, "locators": [ { "artifact_digest": "sha256:e6795254b882d12553f2e5df9c22a38dcfeaa549dfa334ff716a0860303e6a8e", "start_byte": 9286, "end_byte": 9932, "value_digest": "sha256:45bbe217e840df39d07dcf7da82157fa8f1142d0bf5edc5df1af1debd0dbe5df" } ] } ], "note": "Requests to HubSpot API endpoints support scoped request-time authentication using an access token passed via the HTTP Authorization header as 'Bearer [YOUR_TOKEN]'." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:32.728Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "crm-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:455abedca7a40ea9c4389671a9fb1668fa3262904926893b7cd22f5bfdf507c9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5cdace01395b6c44bb4cbae7421cff5fdedc6a0424d6d6a6e612787b93a2cee8", "sha256:62b090664baddee217f0ee6cb396d836067021a2d06fda285d27439dc5ef620b", "sha256:7a84c1d0c588ba670ed0cb116985a03916a33dbace96e926deaec65368794651", "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3" ], "source_surface": { "node_kind": "resource", "node_id": "api-overview" }, "locators": [ { "artifact_digest": "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3", "start_byte": 3970, "end_byte": 4774, "value_digest": "sha256:d8ccbdc4975b479689984c2d9a6d6b7001654f4367426f1cd1319ecdcc07dbb1" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c81368126aa9d750904ca32c7c900dfd2100f16e7304e77a0b2967cf06fc0eb0", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5bf8ebde608d6732839516120776d7c90e79be2e26b0eb8b77c50e3a0a16bed8", "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "sha256:a018ce10fa94570ca2a05658f326a5df113e92df2d46e24f62dab19a7ea7a788" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "start_byte": 8624, "end_byte": 9429, "value_digest": "sha256:d678e52c2dca044741a094a9a8d7446de2a7edc607aff34ffc18b6a43759e28c" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ade61c36c6a51f142cc97c726733be3e2850cb070b54e0daf27179a50ae73235", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5d7c3be181e6d714bbad0c4e220feab8882a06f3d48320f717f5cb7a0bd96352", "sha256:a470c6ba6259ba2d72aef0fe78c27fbaf464a560e8b4cb8e705b280752f68f69", "sha256:f467948c6f3297ebbe20e4392323ba70127978eed77b221b07c838bf19885a1e" ], "source_surface": { "node_kind": "resource", "node_id": "api-limits" }, "locators": [ { "artifact_digest": "sha256:5d7c3be181e6d714bbad0c4e220feab8882a06f3d48320f717f5cb7a0bd96352", "start_byte": 14867, "end_byte": 15605, "value_digest": "sha256:d4af4f9f4e30a5f041a6b38f66a031067c081e53769804fe7271c9d06c8901ea" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:51f922c47089a2d9d66a1749515c728607a78b4fe8520e7e3b696645ab781214", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7a1c92638f79d66a6e149bfd2b7f04061c5fc1f92effc7c66950d626b73c7c3d", "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "sha256:f1746c69c5dee859873c94472bb87b19ae9bdbcccabbb4a3af79618e01805005" ], "source_surface": { "node_kind": "resource", "node_id": "crm-operations" }, "locators": [ { "artifact_digest": "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "start_byte": 6624, "end_byte": 7422, "value_digest": "sha256:da70de3aa7314348983240d1517f10db51c9150343a133987b9dc890f148c9ae" } ] } ], "note": "HubSpot API documentation defines REST endpoints, methods, parameters, JSON error structures, rate limit headers (such as X-HubSpot-RateLimit-Max), and detailed request/response schemas for CRM object operations." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:32.728Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "crm-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ade61c36c6a51f142cc97c726733be3e2850cb070b54e0daf27179a50ae73235", "capture_rung": "http" } ], "artifact_digests": [ "sha256:405dd2adc679f243a31fcabf11bada70a7d6d1c3c4e8e81d4df357f4ba3bda18", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5d7c3be181e6d714bbad0c4e220feab8882a06f3d48320f717f5cb7a0bd96352", "sha256:a470c6ba6259ba2d72aef0fe78c27fbaf464a560e8b4cb8e705b280752f68f69" ], "source_surface": { "node_kind": "resource", "node_id": "api-limits" }, "locators": [ { "artifact_digest": "sha256:5d7c3be181e6d714bbad0c4e220feab8882a06f3d48320f717f5cb7a0bd96352", "start_byte": 7655, "end_byte": 8459, "value_digest": "sha256:e200283ecd9c35847a48311f4bbd62c5a246b52c34cbe554b3eb2c9ebd55bdcd" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c81368126aa9d750904ca32c7c900dfd2100f16e7304e77a0b2967cf06fc0eb0", "capture_rung": "http" } ], "artifact_digests": [ "sha256:00c98fa0acb0810cff4e90b42f9945d8d7c82cd5ed70b88d30263deb44e8fd9c", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "sha256:a018ce10fa94570ca2a05658f326a5df113e92df2d46e24f62dab19a7ea7a788" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:6df6f7dd2fc6d3c4c5ed496d0ff5d15d21f326629893b0c3f3a5cf77a9af1145", "start_byte": 4628, "end_byte": 5431, "value_digest": "sha256:7f91a8eb14134db4bf33c59941c13b887460857edf1a201dad053dec839e98b0" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:455abedca7a40ea9c4389671a9fb1668fa3262904926893b7cd22f5bfdf507c9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5cdace01395b6c44bb4cbae7421cff5fdedc6a0424d6d6a6e612787b93a2cee8", "sha256:62b090664baddee217f0ee6cb396d836067021a2d06fda285d27439dc5ef620b", "sha256:7a84c1d0c588ba670ed0cb116985a03916a33dbace96e926deaec65368794651", "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3" ], "source_surface": { "node_kind": "resource", "node_id": "api-overview" }, "locators": [ { "artifact_digest": "sha256:c1db4c9d30ca7766dd85df625b828afd18941958eddd2f446c0b43ecf4f149b3", "start_byte": 3970, "end_byte": 4774, "value_digest": "sha256:d8ccbdc4975b479689984c2d9a6d6b7001654f4367426f1cd1319ecdcc07dbb1" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:51f922c47089a2d9d66a1749515c728607a78b4fe8520e7e3b696645ab781214", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9ae294e06a20a76cfbd8bb7b98ea4f72da8680c92626c4f975b2f3604dd3340c", "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "sha256:f1746c69c5dee859873c94472bb87b19ae9bdbcccabbb4a3af79618e01805005" ], "source_surface": { "node_kind": "resource", "node_id": "crm-operations" }, "locators": [ { "artifact_digest": "sha256:c8ce0571de8dd969519fb4805b4044fbde769ddab2ad3ec280f62f677d3bd2c5", "start_byte": 15164, "end_byte": 15977, "value_digest": "sha256:f36b7933ec2251b2966945bcca313d317a5709c50e30516da7bfb31530186eb7" } ] } ], "note": "Documented HTTP REST API interfaces are available across all essential target documentation resources, allowing machine execution of operations via documented endpoints." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-09-06T08:52:22.641Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:0e6ad74c1bd8d7bf871527ea950936e80587c8f453bbc1a8c163ce67fe55e3d0", "sha256:140bcf0bb9b1be0198b5cf3c5cf61e7415a3680b982e97cd185dfdd401efc347", "sha256:1d9ab86f997135439107fb7961279a2e5eabe55cfb1af80faab44d2dbf20fa23", "sha256:37ce9ac465b6fc335338c58a771f8ecc6adb5de23771edb0a9ac26792f7308c9", "sha256:3f1884c6976a0643cce1ba014983c7c3372f9a315fc6c724ab7d5a310ec9db88", "sha256:48f1743d996360897fb00b21649aecf80a8e1eaead99175a118b6c0d85cbde91", "sha256:50f22958006d0b71713001967334e0d727040a073f9f0cfce446a3e179900110", "sha256:605486abfc1b1ddce381cad0ade4cb8cd73a19d41f308c19387e5143c26f0000", "sha256:6c5c0416fe2b3b9d866d381eb7fe8dd8206aca25625a12b466aace3433c33bcc", "sha256:77bfef0182125b210cbda9e2b91b80a5b6a4fc141f2d66a5d3d2acd17ef89037", "sha256:7acd217d50c05a7b39df00d445639654b059b5d10592271241e0ba849542df06", "sha256:7f3829c628ed5624638428166672e6bda37b0b0bd76d7ddac0f0b2ed7a067c5b", "sha256:807520e76a10f4c5ff4cb7a86e1a5b9feec9fa6044b91bed120dbf100af28e54", "sha256:84359b011e1536dc669f7dbdd6e74c1994834a8d418b7d6a0075eee2635bf5b9", "sha256:9554b434e0d8f7320f5932452683325d0810473eb97e995c6fa2e06b85cd1f0f", "sha256:a0f3117f61fd91542e91d9983e1079a1c64454a046ccabd4b07a2b3cc6584f28", "sha256:a59cab180c4bbe5ca82c535e912c4690a98f3b9546e770fe67f69fe9c8f54788", "sha256:a7f2627d90a79299d3f62cc1c10d576b9c9a53cf20c623ee15091682df21c3cc", "sha256:addcff1ecc07c601c115572de668316dffdc24e31d6ea9ffc792e0cf17202273", "sha256:af06c9e00f9c54e183b561f29a366ac12f083b7f2c5b3b476d368b82aa7edee0", "sha256:b6d4b0b9c6b61a9e665a044aee6a1f1b5101b2e497a3e885d1f8506b176514a7", "sha256:b70fca39cff3cb0f59b9c6492158fc868847d63b11267c36fcaca30e4936ccac", "sha256:be1cc1b58ff9f65f665095b63c0940c69fcd2fb3587608ec3f616939ca37a71e", "sha256:d7b0b27596dc9bc97c6d06ae884afe5c997231aac4e67bdfa6acc47bcd5b0523", "sha256:e0b3a0a188465a3977188d5cfa01c3654daca32e422ed8889734b0ab32045fdf", "sha256:e0b4e68214b5a477eb92c797cb8103688c02ad1e5f9014971598994f5dab9a92", "sha256:e0e92b636125fe9dd9521d98f455ab5f708f738cf308c7c1227d5ba16f07ebf4", "sha256:e173ff2d82e586ae61097fca7d273daa01ef74117adf65d716fbebff79326421", "sha256:e819db88a7e75074d97f836463fd290a9597f862c6b61eeb062c063d6bdaef7c", "sha256:ebb94ac7f3a2c465ce283d9234bb6836f0174b88310a3d4edce66f9e01112219", "sha256:ec243ca2f73be07ee57bc549f0b0c8a0cfa0460d8aecf4723d05bb5afeb66e9f", "sha256:f31fc4550a2067b7adf980df6c08b8eeeabf559f7cacee67640c6c19b44d61f7", "sha256:f59eee16358203736d7400a9fe1b7de85fb0c2c74d3d26f55b4faf36ce270661" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:e0b4e68214b5a477eb92c797cb8103688c02ad1e5f9014971598994f5dab9a92" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:54.788Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:84359b011e1536dc669f7dbdd6e74c1994834a8d418b7d6a0075eee2635bf5b9", "sha256:9554b434e0d8f7320f5932452683325d0810473eb97e995c6fa2e06b85cd1f0f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:52:22.641Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:6c5c0416fe2b3b9d866d381eb7fe8dd8206aca25625a12b466aace3433c33bcc" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:05.662Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:b6d4b0b9c6b61a9e665a044aee6a1f1b5101b2e497a3e885d1f8506b176514a7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:05.662Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:a59cab180c4bbe5ca82c535e912c4690a98f3b9546e770fe67f69fe9c8f54788", "sha256:addcff1ecc07c601c115572de668316dffdc24e31d6ea9ffc792e0cf17202273" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:08.842Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:605486abfc1b1ddce381cad0ade4cb8cd73a19d41f308c19387e5143c26f0000" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:05.662Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:7acd217d50c05a7b39df00d445639654b059b5d10592271241e0ba849542df06" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:20.125Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:3f1884c6976a0643cce1ba014983c7c3372f9a315fc6c724ab7d5a310ec9db88" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:20.125Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:140bcf0bb9b1be0198b5cf3c5cf61e7415a3680b982e97cd185dfdd401efc347", "sha256:f59eee16358203736d7400a9fe1b7de85fb0c2c74d3d26f55b4faf36ce270661" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:20.125Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:0e6ad74c1bd8d7bf871527ea950936e80587c8f453bbc1a8c163ce67fe55e3d0" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:52.529Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:1d9ab86f997135439107fb7961279a2e5eabe55cfb1af80faab44d2dbf20fa23" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:20.125Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:807520e76a10f4c5ff4cb7a86e1a5b9feec9fa6044b91bed120dbf100af28e54" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:38.759Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:ebb94ac7f3a2c465ce283d9234bb6836f0174b88310a3d4edce66f9e01112219" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.481Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:77bfef0182125b210cbda9e2b91b80a5b6a4fc141f2d66a5d3d2acd17ef89037" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:38.759Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:e173ff2d82e586ae61097fca7d273daa01ef74117adf65d716fbebff79326421" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:38.759Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:a0f3117f61fd91542e91d9983e1079a1c64454a046ccabd4b07a2b3cc6584f28" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:52.529Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:e819db88a7e75074d97f836463fd290a9597f862c6b61eeb062c063d6bdaef7c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:32.728Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:48f1743d996360897fb00b21649aecf80a8e1eaead99175a118b6c0d85cbde91" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:32.728Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:7f3829c628ed5624638428166672e6bda37b0b0bd76d7ddac0f0b2ed7a067c5b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:05.662Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:e0e92b636125fe9dd9521d98f455ab5f708f738cf308c7c1227d5ba16f07ebf4" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:59.751Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:af06c9e00f9c54e183b561f29a366ac12f083b7f2c5b3b476d368b82aa7edee0" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:40.067Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:b70fca39cff3cb0f59b9c6492158fc868847d63b11267c36fcaca30e4936ccac" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:59.751Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:37ce9ac465b6fc335338c58a771f8ecc6adb5de23771edb0a9ac26792f7308c9", "sha256:50f22958006d0b71713001967334e0d727040a073f9f0cfce446a3e179900110", "sha256:a7f2627d90a79299d3f62cc1c10d576b9c9a53cf20c623ee15091682df21c3cc", "sha256:ec243ca2f73be07ee57bc549f0b0c8a0cfa0460d8aecf4723d05bb5afeb66e9f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:32.728Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:be1cc1b58ff9f65f665095b63c0940c69fcd2fb3587608ec3f616939ca37a71e", "sha256:d7b0b27596dc9bc97c6d06ae884afe5c997231aac4e67bdfa6acc47bcd5b0523", "sha256:e0b3a0a188465a3977188d5cfa01c3654daca32e422ed8889734b0ab32045fdf", "sha256:f31fc4550a2067b7adf980df6c08b8eeeabf559f7cacee67640c6c19b44d61f7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:32.728Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/hubspot/agent-readiness/hubspot-crm-api/api-integration-lifecycle", "projection_digest": "sha256:1d244b7de425efc171a115db567d66d046020798b9c00a916be5eb1ae8fd77d2" } } }