HubSpot API: Full 2026 Developer Review

The question behind any CRM API integration is whether the platform exposes enough to justify the dependency, or whether you will spend more time working around its limits than building on its strengths.

HubSpot's API is a REST surface covering 30+ CRM object types, with date-based versioning (currently /2026-03/), OAuth 2.0 authentication, official SDKs in six languages, webhooks with signed payloads, and a GraphQL endpoint for CMS queries.

The developer portal is public, the API reference is interactive, and the documentation includes an llms.txt index for AI-assisted development. For a platform serving 288,000+ customers, that is a serious developer investment.

But breadth of CRM endpoints and depth of data intelligence are different things.

HubSpot's API gives you programmatic control over CRM records, pipelines, marketing automation, content, and commerce workflows. If you need to create contacts, manage deals, trigger sequences, subscribe to property-change webhooks, or build marketplace apps, the API covers that ground with published rate limits and an 18-month version support window.

Where its scope stops is upstream data intelligence: it does not offer contact or company search across an external database, buyer intent signals, technographic profiling, org chart traversal, direct-dial phone number discovery, or AI-powered account research. The CRM manages the records you put into it; it does not go out and find new ones.

This is where ZoomInfo, the AI GTM platform, enters the picture. Its Enterprise API is a REST suite covering search, enrichment, AI intelligence, and audience management across 500M contacts and 100M companies, with an MCP server for AI-agent workflows. It is the data intelligence layer that feeds a CRM, not a CRM itself, and it pairs with HubSpot's API as a complement rather than a competitor.

This review covers the HubSpot API in technical depth first (authentication, endpoints, webhooks, SDKs, rate limits, and pricing), then reviews ZoomInfo's API as the intelligence layer that provides the data HubSpot's CRM is built to receive.

HubSpot API at a Glance

HubSpot API: What Works Well & What to Plan Around

HubSpot API: Authentication & Getting Started

API access is available on every HubSpot plan, including the free tier. A free developer account lets you build and test without a paid subscription. There is no separate developer signup gate or API approval process.

HubSpot supports multiple authentication methods depending on how your app is distributed:

OAuth 2.0 (Authorization Code flow): Required for publicly distributed apps listing on the HubSpot Marketplace, and for multi-account private OAuth apps. Developers host an OAuth backend to initiate the flow and manage tokens. Access tokens include an expires_in parameter; apps must refresh tokens before expiry. A Node.js OAuth quickstart guide with Docker-compatible code is available.

Source: HubSpot

Static auth access token: For single-account (private distribution) apps, a non-expiring Bearer token is generated in app settings. Distribution is limited to 10 authorized accounts.

Legacy private app access tokens: Generated via scope-based configuration in the HubSpot UI for legacy private apps. Supports rotation (immediate or scheduled 7-day). HubSpot emails super admins rotation reminders every 180 days.

All tokens are passed as a Bearer token in the Authorization header:

curl "https://api.hubapi.com/crm/objects/2026-03/contacts" \

-H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Apps declare permission scopes at configuration time, defining which data and functionality each app can access. HubSpot signs outbound webhook requests with an X-HubSpot-Signature header (SHA-256 hash from the app's client secret and request body), letting receivers verify that requests originate from HubSpot.

HubSpot API: Core Endpoints & Capabilities

HubSpot's CRM is built on an Object API model. Each CRM object type has a numeric objectTypeId, and a single set of standardized endpoints handles all object types:

GET /crm/objects/2026-03/{objectTypeId} — list records

POST /crm/objects/2026-03/{objectTypeId} — create record

GET /crm/objects/2026-03/{objectTypeId}/{id} — retrieve record

PATCH /crm/objects/2026-03/{objectTypeId}/{id} — update record

DELETE /crm/objects/2026-03/{objectTypeId}/{id} — archive record

POST /crm/objects/2026-03/{objectTypeId}/batch/create — bulk create

POST /crm/objects/2026-03/{objectTypeId}/search — filter/search

Once you know how to work with one object type, the same approach applies to all 30+. Records are identified by an auto-generated hs_object_id (treated as a string); contacts can also be looked up by email and companies by domain via the idProperty query parameter. Pagination uses cursor/limit patterns.

Contacts, Companies & Deals

The core CRM objects (Contacts at 0-1, Companies at 0-2, Deals at 0-3) support the full CRUD lifecycle plus batch operations and search. What you would build with this: a CRM sync that pushes contacts from an external data source into HubSpot, associates them with companies, creates deals, and tracks pipeline progression, all programmatically.

Tickets, Products & Commerce Objects

Tickets (0-5), Products (0-7), Line Items (0-8), Quotes (0-14), Invoices (0-53), Orders (0-123), Payments (0-101), and Subscriptions (0-69) extend the same endpoint pattern to service and commerce workflows. What you would build with this: a quote-to-cash automation that creates products, generates quotes from deal context, tracks invoices, and reconciles payment records.

Custom Objects

Custom objects (type IDs prefixed 2-) let you extend the CRM data model for any business entity HubSpot does not natively cover. The Schemas API (/crm-object-schemas/2026-03/schemas) handles creation and configuration of custom object definitions (object name, display properties, searchable properties, associations).

Associations API

The Associations API (/crm/associations/2026-03/) manages relationships between records across object types. It supports custom association labels (e.g., "Decision Maker"), enabling multi-relationship modeling. This API has stricter rate limits than the general CRM endpoints.

Search API

The Search API (/crm/objects/2026-03/{objectTypeId}/search) filters and sorts CRM records by properties and associations. Use it to query existing records by criteria (e.g., "all contacts at companies with 500+ employees who opened an email this month"). This endpoint also has specific rate limits documented separately.

Source: HubSpot

Properties API

The Properties API (/crm/properties/2026-03/{objectTypeId}) creates and manages default and custom properties for each object type, giving you control over the field schema of every object in the CRM.

Marketing, Forms & Conversations

Marketing APIs include Transactional Email (single-send), Marketing Events, and Forms APIs. The Conversations API handles messaging channel integrations and inbox management, requiring a developer API key for registration.

Exports API

The Exports API handles bulk CRM data extraction with specific documented limits, useful for data warehousing or migration workflows.

GraphQL API

A GraphQL endpoint is available for querying CMS content and HubDB tables, subject to query complexity limits. This is scoped to CMS data, not general CRM access.

HubSpot API: Webhooks & Events

HubSpot supports webhooks in both private apps and public apps, delivering event data via HTTP POST to a developer-configured target URL.

Source: HubSpot

Supported event sources:

• CRM objects: Contacts, Companies, Deals, Tickets, Products, Line Items

• Conversations (inbox events)

Event types per CRM object: created, merged, deleted, and property changed (with optional property-level filtering, so you can subscribe to specific property changes rather than receiving every change for an object).

Delivery behavior:

• HubSpot enforces a concurrency limit of 10 in-flight requests per private app, with each request containing up to 100 events.

• Every webhook request is signed with an X-HubSpot-Signature header for origin validation.

• A test mode sends a sample payload so you can inspect the response.

• Webhook logs (successful and failed requests, searchable by batch ID or log ID) are available in the app's Logs tab.

Constraints to plan around:

• Up to 1,000 webhook subscriptions per app.

• Private app webhook subscriptions cannot be managed programmatically; you configure them only through the HubSpot UI.

• A separate Webhooks Journal API (authenticated via client credentials) exists for reading webhook delivery history programmatically.

What you would build with this: a real-time integration that listens for deal stage changes, new contact creations, or ticket status updates and pushes those events into an external system (a data warehouse, a Slack channel, or a workflow engine) without polling.

HubSpot API: SDKs, Docs & Rate Limits

SDKs & Libraries

HubSpot maintains official SDKs for six languages (updated in June 2026 to support date-based versioning):

• PHP

• Java

• Ruby

• Go

• TypeScript (Node.js, distributed via npm)

• Python

The SDKs are generated from a centrally managed OpenAPI specification, so coverage expands as the spec evolves and documentation drift shrinks. Repositories live under github.com/HubSpot.

Beyond the SDKs, HubSpot provides developer tooling that goes further than most CRM APIs:

• HubSpot CLI: command-line tooling for building, deploying, and managing HubSpot projects

• VS Code extension: HubL syntax highlighting, autocomplete, and config file validation

• Local development MCP server: AI-assisted coding and project management in IDE environments

• Remote HubSpot MCP server: generally available since April 2026 for read/write CRM access via MCP-compatible AI agents

• GitHub Actions integration: CI/CD for the developer platform

Source: HubSpot

Documentation & Developer Experience

The developer documentation lives at developers.hubspot.com and is organized into API reference, apps, CMS, and developer tooling sections.

The date-based API reference covers endpoints released since /2026-03/, with an older numeric-version reference (v1-v4) still available. A complete documentation index is available via llms.txt for machine-readable discovery by AI tools. The docs use a Mintlify-based interactive explorer embedded in reference pages.

Source: HubSpot

The date-based versioning system gives developers an 18-month support window per version and limits breaking changes to twice per year (March and September). An active Developer Changelog tracks updates by API area.

Developer support channels include:

• Developer Community (forum and Slack workspace)

• Developer Blog

• HubSpot Academy (certifications and courses)

• HubSpot Developers YouTube channel

• Developer Newsletter (monthly)

• Status page (API uptime and incident monitoring)

• GitHub organization (open SDK repos)

HubSpot's developer experience is mature and well-maintained. Generated SDKs, interactive docs, predictable versioning, and AI-native tooling (MCP servers, Agent CLI) put it ahead of most CRM APIs in developer investment.

Rate Limits & Constraints

Rate limits vary by app distribution type and HubSpot subscription tier.

Publicly distributed OAuth apps (marketplace-listed):

• 110 requests per 10 seconds per installed HubSpot account

• This limit cannot be increased with the API Limit Increase add-on

Privately distributed apps:

Other constraints worth knowing:

• Up to 20 legacy private apps per HubSpot account

• Up to 100 legacy public apps per developer account

• Custom events: 500 unique event definitions per account, 30 million event completions per month

• Marketplace apps must stay under a 5% daily error rate for certification eligibility

• API polling interval minimum: 5 minutes

• CRM Search API and Associations API have stricter limits documented on their individual guide pages

Rate limit violations return a 429 error with "errorType": "RATE_LIMIT". The limits are well-documented and explicit, which is a genuine strength: discovering rate limits in production is far worse than reading them in advance.

Source: HubSpot

HubSpot API Pricing & Access Costs

HubSpot bundles API access into all subscription plans, including the free tier. There is no separate API access fee. The base API call volume by plan:

For most builds, those daily ceilings are generous. A CRM sync polling every 5 minutes and processing a few hundred records per cycle will not come close to 250,000 calls in a day. The ceiling matters for high-frequency integrations: real-time enrichment, marketplace apps serving many accounts, or bulk migration scripts.

API Limit Increase add-on: $500/month per capacity pack. Each pack adds 1,000,000 API calls/day and raises the rate limit to 250 requests per 10 seconds. You can buy a maximum of two packs per account (ceiling: up to 3,000,000 calls/day on Enterprise with two packs). The add-on does not raise the 110 req/10 sec limit for publicly distributed marketplace apps.

For a developer sizing costs: the API itself is free on every plan. The real cost is the HubSpot subscription tier that determines your daily call ceiling, rate limit, and feature access. A free account gives you 250,000 API calls/day and 100 req/10 sec, enough to build and test a production integration.

If you need more, Professional at $90-100/seat/month nearly triples the daily ceiling. The $500/month API Limit Increase is the escape valve for integrations that need volume beyond what Enterprise provides.

Where the HubSpot API Falls Short

These are the practical limits a developer building a data pipeline should plan around. Several are scope decisions that reflect what HubSpot's API is (a CRM platform API) and what it is not.

No external contact or company search. HubSpot's Search API queries records already in your CRM. There is no endpoint to search an external database of contacts or companies, discover new prospects, or find people at a target account who are not yet in your system. If your build requires prospecting (finding new contacts by title, company size, or industry), HubSpot's API does not cover it.

No buyer intent, technographics, or org chart data. The API does not expose buyer intent signals (which companies are actively researching your category), technology stack profiles, or organizational hierarchy data.

These signals help a builder decide which accounts to prioritize and which contacts to reach. HubSpot's Breeze AI features use some of these signals internally, but they are not available as API endpoints.

No direct-dial phone number discovery. HubSpot stores phone numbers that users or integrations put into the CRM, but the API does not provide a phone number lookup or verification service. If your pipeline needs verified direct dials, you need an external data source.

Private app webhook subscriptions are UI-only. You cannot create, update, or delete webhook subscriptions in private apps via API. You must configure them manually in the HubSpot settings UI. For a developer managing webhooks across environments (dev, staging, production) or automating integration setup, this creates real friction.

Marketplace apps hit a hard 110 req/10 sec ceiling. Publicly distributed apps are capped at 110 requests per 10 seconds per installed account, and the API Limit Increase add-on does not apply. For a marketplace app serving customers with high-volume CRM operations, this ceiling cannot be raised.

GraphQL is CMS-only. The GraphQL API is scoped to CMS content and HubDB tables, not general CRM access. Developers who prefer GraphQL for CRM queries must use the REST endpoints.

Rate limits on Free and Starter are shared across all private apps. The 250,000 calls/day limit on Free and Starter tiers is per account, shared across all private apps. Multiple integrations running against the same account compete for the same capacity.

ZoomInfo API: The Data Intelligence Layer HubSpot Does Not Provide

HubSpot's API manages CRM records, pipelines, and workflows. ZoomInfo's API provides the intelligence that determines which records belong in the CRM in the first place: who to contact, what companies they work for, what technology those companies use, and whether they are actively in-market.

That intelligence flows from the GTM Context Graph, which processes 1.5B+ data points daily by fusing ZoomInfo's B2B data with your first-party signals.

Source: ZoomInfo

The two APIs operate at different layers of a GTM data pipeline. HubSpot is the system of record; ZoomInfo is the data source that feeds it.

What the API Covers: Search, Enrichment, and AI Intelligence

ZoomInfo's Enterprise API is a REST suite served from https://api.zoominfo.com/gtm, organized into four areas documented in the interactive API reference:

Data API (Search & Enrich): Search endpoints cover Contacts, Companies, Intent, News, and Scoops, returning matched records without consuming credits.

Source: ZoomInfo

Enrich endpoints unlock the full payload: business emails, direct dials, employment history, corporate hierarchy, org charts, technographics, and hashtag signals, up to 25 records per call.

Source: ZoomInfo

The underlying dataset spans 500M contacts, 100M companies, 135M+ verified phone numbers, and 200M+ verified business email addresses. The search-then-enrich pattern means you filter freely, then pay only for the records you commit to.

Source: ZoomInfo

AI Intelligence Endpoints: Account Summary returns structured account intelligence with a free-form Q&A endpoint. Find Similar Companies performs lookalike expansion. Contact Recommendations returns AI-ranked buying-committee suggestions by motion (prospecting, deal acceleration, renewals).

Marketing API: CRUD endpoints for programmatic audience management.

Platform API (Engagements, Beta): Bidirectional engagement data via the Engagements API.

The pairing with a CRM API is direct: use ZoomInfo's search endpoints to find contacts matching your ICP (free, no credits consumed), enrich the ones worth pursuing, then push them into HubSpot's CRM object endpoints. ZoomInfo's search does what HubSpot's Search API cannot: query an external intelligence database rather than your own records.

Authentication & Access

ZoomInfo uses OAuth 2.0 with PKCE via Okta, supporting three flows: Authorization Code with PKCE (web applications), Client Credentials (server-to-server), and Refresh Token. Access tokens are 24-hour Bearer tokens with rotating refresh tokens. Teams register applications through the ZoomInfo Developer Portal, where they generate credentials, define scopes, and test endpoints.

Source: ZoomInfo

Both APIs use OAuth 2.0, but ZoomInfo's implementation is more prescriptive (Okta-based, 24-hour token expiry with mandatory rotation), while HubSpot offers more flexibility (static tokens for simple integrations, OAuth for marketplace apps, legacy tokens for backward compatibility).

Rate Limits, Credits & Developer Experience

Rate limits are published by tier: Builder (5 req/sec), Standard (25 req/sec), and Scaling (35 req/sec), with per-hour and per-day sliding-window limits enforced simultaneously. Every response includes quota headers with remaining capacity, and 429 responses include a Retry-After header with exact backoff timing.

Source: ZoomInfo

Credits follow a rolling 12-month window: enriching a record for the first time consumes one credit; re-enriching the same record within the year is free. Search and lookup operations do not consume credits.

For developers building AI agents, ZoomInfo's MCP server at https://mcp.zoominfo.com/mcp exposes search, enrich, and account research as native tools for MCP-compatible assistants, currently supporting Claude and ChatGPT. A separate Docs MCP server enables AI-assisted code generation against the API spec.

Source: ZoomInfo

ZoomInfo does not publish official SDKs, so you integrate over HTTP and own the auth-and-retry layer yourself. Documentation lives at docs.zoominfo.com with an interactive API reference, OAuth recipes in five languages, and an llms.txt index for AI development tools. ZoomInfo has added API access to all plans, with consumption-based pricing.

BDO Canada reported an 87% reduction in time spent updating internal data dashboards using the ZoomInfo API, with one analyst describing the integration as plug-and-play across any process. (ZoomInfo)

Final Verdict

HubSpot's API is a strong CRM platform surface: well-versioned, well-documented, and broad enough to cover 30+ CRM object types, marketing automation, commerce, and webhooks from a single REST interface. Six official SDKs, generated from a central OpenAPI spec, reduce integration overhead.

Date-based versioning with 18-month support windows gives developers stability guarantees that are rare for a SaaS API. For a build that starts and ends with CRM workflow automation, it delivers what the platform does, programmatically.

Choose the HubSpot API if your integration manages CRM data: syncing contacts and companies from external systems, automating deal pipelines, subscribing to property-change events, building marketplace apps, or orchestrating marketing and service workflows. The free tier with 250,000 calls/day and $0 API access cost make it one of the most accessible CRM APIs to build on.

Choose the ZoomInfo API when your build needs the intelligence upstream of CRM management: deciding which contacts to create, which companies to target, what those companies' technology stacks look like, and whether they are actively in-market.

The search-then-enrich pattern (search is free, enrich consumes credits) and the AI intelligence endpoints cover the data a CRM API does not. Explore the ZoomInfo Enterprise API or start with the developer docs to see the endpoint surface directly.

A developer who needs neither should consider that HubSpot's API does not discover or verify contacts, and ZoomInfo's API does not manage CRM records. If your pipeline requires both, the two are complementary layers in the same build, not competing surfaces.

FAQ

Is the HubSpot API free?

Yes. API access is included on all HubSpot plans, including the permanent free tier. There is no separate API fee. The free plan provides 250,000 API calls per day and 100 requests per 10 seconds, enough for most integrations.

The real cost factor is the HubSpot subscription tier: Professional and Enterprise plans increase the daily call ceiling and rate limits. An API Limit Increase add-on is available at $500/month for builds that need more than 1,000,000 calls/day.

Does HubSpot have a GraphQL API?

Yes, but it is limited in scope. HubSpot's GraphQL API covers CMS data-driven content queries (HubDB tables and CMS content), not general CRM access. CRM operations (contacts, companies, deals, tickets, and all other object types) use the REST API exclusively. The GraphQL endpoint is subject to its own query complexity and account limits.

What is the HubSpot API rate limit?

It depends on your app type and subscription tier. Publicly distributed OAuth apps are capped at 110 requests per 10 seconds per installed account, and this limit cannot be increased. Private apps on Free and Starter plans get 100 requests per 10 seconds and 250,000 calls/day; Professional and Enterprise get 190 requests per 10 seconds with 625,000-1,000,000 calls/day.

The API Limit Increase add-on ($500/month) raises private app limits to 250 requests per 10 seconds and adds 1,000,000 calls/day per capacity pack. The CRM Search API and Associations API have additional, stricter limits documented on their respective pages.

Are there official HubSpot SDKs?

Yes. HubSpot publishes official SDKs for six languages: PHP, Java, Ruby, Go, TypeScript, and Python. All are generated from a centrally managed OpenAPI specification and were updated in June 2026 to support the new date-based versioning.

They are distributed through standard package managers and maintained under the HubSpot GitHub organization. Beyond the SDKs, HubSpot also provides a CLI, a VS Code extension, and MCP servers for AI-assisted development.

Does the HubSpot API support webhooks?

Yes. HubSpot webhooks deliver CRM object events (created, merged, deleted, property changed) and Conversations events via signed HTTP POST requests. Up to 1,000 subscriptions per app are supported.

Each webhook request can contain up to 100 events, with a concurrency limit of 10 in-flight requests per private app. Payloads are signed with an X-HubSpot-Signature header for verification. One constraint: private app webhook subscriptions can only be configured in the HubSpot UI, not via API.

What does ZoomInfo's API add to a HubSpot build?

ZoomInfo's API adds the data intelligence layer that HubSpot's CRM API does not cover.

Where HubSpot's API manages existing CRM records, ZoomInfo's API searches across 500M contacts and 100M companies to find new prospects matching your ICP, enriches them with direct dials, org charts, technographics, and employment history, and detects buyer intent signals showing which accounts are actively in-market.

The typical integration pattern: use ZoomInfo's search endpoints to discover contacts (free, no credits consumed), enrich the ones worth pursuing (one credit per new record), then push the enriched records into HubSpot's CRM object endpoints.

Both APIs use OAuth 2.0 and Bearer tokens, and ZoomInfo's MCP server extends the same intelligence to AI-agent workflows that can read and write HubSpot CRM data via HubSpot's own MCP server.