HubSpot setup - Configview Support

ConfigView reads your HubSpot account through HubSpot’s API, using the access token of a private app that a super admin creates in HubSpot. You will end up with 1 secret in ConfigView (HUBSPOT_PRIVATE_APP_TOKEN) when setup is complete.

Scope of this integration today. ConfigView reads who has HubSpot, their permission set, teams and paid seats, who is a super admin, every sign-in attempt, and HubSpot’s security log: integrations installed, data exports, users added, removed or deactivated, admin rights granted, two-factor and single sign-on changes, and private app tokens viewed. On Enterprise it also reads the audit log. ConfigView only reads. It never reads contacts, companies, deals, tickets or any other CRM record, and never changes anything.

Step 1: Open the HubSpot page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/hubspot

Step 2: Create a private app in HubSpot

You need to be a HubSpot super admin to create a private app.

Sign in to HubSpot as a super admin
In the main navigation, open Development, then Legacy apps in the left sidebar. (Older portals: Settings → Integrations → Private apps.) HubSpot now calls private apps “legacy apps”, but they are fully supported and are the right choice for a read-only connection to your own portal
Click Create legacy app, then choose Private
On the Basic Info tab, name it ConfigView and add a short description, for example Read-only access review
Open the Scopes tab, click Add new scope, and tick only these three read scopes:

Scope	What it lets ConfigView read
`settings.users.read`	Users, their permission sets, seats and super admin flag
`settings.users.teams.read`	Teams and who belongs to them
`account-info.security.read`	Login history, security activity and (Enterprise) the audit log

Do not add any crm.* scope. ConfigView never reads CRM records 6. Leave the Webhooks tab empty 7. Click Create app, then Continue creating 8. On the app’s page, open the Auth tab, click Show token, then Copy. The token starts with pat- 9. Switch to the ConfigView tab, paste it into HUBSPOT_PRIVATE_APP_TOKEN under Credentials, and click the save icon

Keep the token working

Who creates the app matters. If the super admin who created the private app is later removed from HubSpot, the token starts failing. Create it from an admin who is staying, or a shared admin account.
Rotating the token. HubSpot recommends rotating private app tokens every six months (Auth tab → Rotate). “Rotate and expire later” keeps the old token working for 7 days. Paste the new token into ConfigView before it expires.
Viewing the token is logged. Every time someone clicks Show token, HubSpot records it in the security log, and ConfigView reports it (see Private app tokens and keys viewed or changed).

Step 3: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/hubspot, confirm the credential shows as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Users	Every HubSpot user: name, email, permission set, primary and secondary teams, paid seats held, and whether they are a super admin.
Permission Sets	Permission sets (roles) defined in the account, and whether each one can change billing.
Teams	Teams and the users who belong to each, as primary or secondary members.
Login History	Every sign-in attempt, web and mobile, successful or failed: who, when, IP address, country and region, and browser.
Security Activity	Security events: integrations installed or removed, contact and user exports, users added, removed, deactivated or impersonated, admin rights granted, two-factor and single sign-on changes, private app tokens viewed or rotated, permanent deletions.
Audit Log	Enterprise only. Who did what and when across HubSpot: record and property changes, workflow and content edits, approvals and critical actions. Records the category, action and the id of what was touched, never the record’s contents.

Click Verify now. The health check confirms the token, reads the portal id and the token’s scopes, and makes one small read from each endpoint.

If a check fails:

“Token scopes” fails naming a scope. Open the private app’s Scopes tab, add the scope it names, and save. The same token picks up the new scope; you don’t need to paste it again.
401, or “the token is wrong, rotated or expired”. The token was rotated or mistyped. Copy it again from the Auth tab.
“Audit log (Enterprise)” is skipped. Expected on Starter and Professional: HubSpot only offers the audit log API on Enterprise.

Plan requirements

Data	Free	Starter	Professional	Enterprise
Users, permission sets, teams	✓	✓	✓	✓
Login history, security activity	see note	✓	✓	✓
Audit log				✓

HubSpot’s API reference lists login history and security activity on every tier, while its Knowledge Base lists the activity history from Starter up. On a Free portal the health check will tell you which one applies.

API usage

HubSpot gives each portal a daily API limit (250,000 calls on Free and Starter, 625,000 on Professional, 1,000,000 on Enterprise) that is shared by every private app in the portal, including your other integrations. ConfigView keeps its share small:

A normal day costs a few dozen calls. The user, team and permission set lists are one to a few calls each, and the activity logs only read what is new since the last run.
The first run reads HubSpot’s whole retained history (90 days of sign-ins and security activity, and 90 days of audit log on Enterprise), which can take a few hundred to a few thousand calls on a large, busy portal.
Every collector stops early if less than 10% of the day’s limit is left, and caps the calls it makes in one run.
ConfigView paces itself at about 2 calls a second, well under HubSpot’s per-app burst limit.

You can see ConfigView’s calls on the private app’s Logs tab in HubSpot.

Data Tables

Once the scripts run, these tables are created in your database. Each has a run_at column and a raw_json column holding the record as HubSpot returned it. The user, permission set and team tables are snapshots: each run replaces the previous one. The login, security and audit tables are histories: each event is stored once and kept, so they grow past HubSpot’s own 90-day window.

Table	Source	Key Columns
`hubspot_users`	`GET /settings/users/2026-09`	user_id, email, first_name, last_name, role_id, role_ids, primary_team_id, secondary_team_ids, seat_names, super_admin
`hubspot_roles`	`GET /settings/users/2026-09/roles`	role_id, name, requires_billing_write
`hubspot_teams`	`GET /settings/users/2026-09/teams`	team_id, name, user_ids, secondary_user_ids, member_count
`hubspot_login_history`	`GET /account-info/2026-09/activity/login`	login_id, login_at, user_id, email, login_succeeded, ip_address, location, country_code, region_code, user_agent
`hubspot_security_activity`	`GET /account-info/2026-09/activity/security`	event_id, created_at, user_id, activity_type, acting_user_email, object_id, info_url, ip_address, location, country_code, region_code
`hubspot_audit_logs`	`GET /account-info/2026-09/activity/audit-logs`	event_id, occurred_at, category, sub_category, action, target_object_id, acting_user_id, acting_user_email

Things worth knowing

Installed apps are named by id only. HubSpot’s security log records an integration install as INSTALL_INTEGRATION with the app’s id in object_id, not its name. Match the id against Settings → Integrations → Connected apps in HubSpot. Removals are recorded as UNINSTALL_INTEGRATION. Find super admins with super_admin = 1. Super admin overrides any permission set, so don’t rely on role_id to spot them. Seats are names, not counts. seat_names lists the paid seats a user holds (for example sales-hub-professional). How many seats remain unassigned needs a billing scope that ConfigView deliberately does not ask for. User events point at user ids. For ADD_USER, REMOVE_USER, DEACTIVATE_USER and admin grants, object_id in hubspot_security_activity holds the affected user’s id, which joins to hubspot_users.user_id. The catalog questions about deactivated users rely on this. Audit log volume. On a busy Enterprise portal the audit log records every property change, so this table grows fastest. It holds ids and action names only, never field values.

What isn’t collected

Contacts, companies, deals, tickets, emails, notes or any other CRM record or property value
The private app token itself, other apps’ tokens, client secrets or API keys. Only the fact that one was viewed, created or rotated
Exported files. Only who exported, when and from where

​Step 1: Open the HubSpot page in ConfigView

​Step 2: Create a private app in HubSpot

​Keep the token working

​Step 3: Connect and verify

​Plan requirements

​API usage

​Data Tables

​Things worth knowing

​What isn’t collected