Skip to main content

HubSpot signed contact import

Import selected HubSpot contacts from a signed provider card request.

POST/api/crm/external-actions/hubspot/import-records
HTTP referenceScope HubSpot signature required; developer API keys unsupportedUpdated October 15, 2026

This page documents the canonical HTTP contract for this endpoint.

Provider callback authentication: HubSpot must sign the exact method, URL, and raw body. The handler verifies X-HubSpot-Signature-v3 with X-HubSpot-Request-Timestamp, or an explicitly selected v2 legacy signature using X-HubSpot-Signature and X-HubSpot-Signature-Version: v2. A developer API key or session token does not replace this signature. Do not put Autotouch credentials in a HubSpot card or workflow payload.

The portal ID resolves an existing healthy HubSpot connection and its organization; caller-supplied record fields are not imported as truth. The backend fetches the selected contacts through that connection and reuses the normal bounded import command. Maximum raw JSON body: 128 KiB. These callbacks complete synchronously with per-record outcomes.

Query parameters

  • portalId · optional

    string

    Signed portal identity supplied by hubspot.fetch. Required when the body has no portal ID.

Body parameters

  • portal_id · optional

    string

    HubSpot portal identity. May instead be portalId or the signed portalId/portal_id query parameter. Body and query must agree when both are present.

  • object_type · optional

    string

    HubSpot contact object type; defaults to contact.

  • record_idsrequired

    array<string>

    1–500 non-empty selected contact IDs. The server normalizes and deduplicates them.

Errors

StatusMeaning
400Invalid JSON object, missing or mismatched portal ID, or invalid workflow contact envelope.
401Invalid HubSpot request signature.
409HubSpot is not connected, requires reauthorization, or lacks organization context.
413Body exceeds 128 KiB.
422Invalid selected-record import request.

Docs