HubSpot: Retrieve security history

← Audit logs operations · Get started

Operation hubspot.audit_logs_get_security

Provider route: GET /account-info/2026-09/activity/security. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/hubspot with npm, or alter-sdk-hubspot with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { HubSpotIntegration } from "@alter-ai/hubspot";

async function execute(input: Parameters<HubSpotIntegration["auditLogs"]["getSecurity"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new HubSpotIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.auditLogs.getSecurity(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_hubspot import HubSpotIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = HubSpotIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.audit_logs.get_security(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
query	object	Optional	Additional keys: not allowed
query.after	string	Optional
query.fromTimestamp	integer	Optional	Format: int64
query.limit	integer	Optional	Format: int32
query.toTimestamp	integer	Optional	Format: int64
query.userId	integer	Optional	Format: int32

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Retrieve security history — response body

Referenced models: Retrieve security history — response body

Schemas

Retrieve security history — response body

Field	Type	Presence	Description and constraints
$	object	Root
paging	Model	Optional	Expand Retrieve login activity — response body — paging
results	array	Required within parent	An array of hydrated critical actions, each containing detailed information about a specific critical action.
results[]	Model	Each item	Expand Retrieve security history — response body — results item

Referenced models: Retrieve login activity — response body — paging, Retrieve security history — response body — results item

Retrieve login activity — response body — paging

Field	Type	Presence	Description and constraints
$	object	Root	Paging information for forward-only pagination. Contains the next page reference when more results are available; omitted or empty on the last page.
next	Model	Optional	Expand Retrieve login activity — response body — paging next

Referenced models: Retrieve login activity — response body — paging next

Retrieve security history — response body — results item

Field	Type	Presence	Description and constraints
$	object	Root
actingUser	string	Optional	Email address of the user associated with the activity.
countryCode	string	Optional	The approximate country code
createdAt	string	Required within parent	The time the activity took place. Format: date-time
id	string	Required within parent	The activity's unique ID.
infoUrl	string	Optional	A link to the URL where the action was taken in the account.
ipAddress	string	Optional	IP address where the activity originated.
location	string	Optional	The approximate location where the activity took place.
objectId	string	Optional	The ID of the affected object.
regionCode	string	Optional	The approximate region code
type	string	Required within parent	The type of activity. Known values: ACCEPTANCE_TEST, ACCOUNT_ADDED_TO_MULTI_ACCOUNT_ORGANIZATION, ACCOUNT_REMOVED_FROM_MULTI_ACCOUNT_ORGANIZATION, ADD_ADMIN_PERMISSIONS, ADD_ADMIN_USER, ADD_SINGLE_SIGN_ON, ADD_TWO_FACTOR_AUTHENTICATION, ADD_USER, ADD_WEBHOOK_IN_WORKFLOW, ALLOWED_GEOLOCATIONS_DISABLED, ALLOWED_GEOLOCATIONS_ENABLED, ALLOWED_LOGIN_METHODS_DELETE, ALLOWED_LOGIN_METHODS_UPDATE, ATTACHMENT_LOGGING_DISABLED, ATTACHMENT_LOGGING_ENABLED, AUTOMATED_INACTIVE_USER_DEACTIVATION_DISABLED, AUTOMATED_INACTIVE_USER_DEACTIVATION_ENABLED, BOTS_WEBHOOK_POST, BOTS_WEBHOOK_UPDATE, BOTS_WEBHOOK_VIEWED, BULK_EMAIL_DOMAIN_CHANGE, CHANGE_AD_EVENT_CONSENT_SETTING, CHANGE_AD_EVENT_DATA_SHARING_SETTING, CHANGE_PASSWORD, CHANNEL_SENSITIVE_DATA_DISABLED, CHANNEL_SENSITIVE_DATA_ENABLED, CONTACT_DATA_EXPORT, CONTACT_OWNER_AUTO_ASSIGN_DISABLED, CONTACT_OWNER_AUTO_ASSIGN_ENABLED, DATA_ACCESS_REQUEST_SUBMITTED, DATA_BACKUP_CREATED, DATA_BACKUP_DOWNLOADED, DATA_BACKUP_SCHEDULE_CREATED, DATA_BACKUP_SCHEDULE_DELETED, DATA_BACKUP_SCHEDULE_UPDATED, DATA_RESTORE_COMPLETED, DATA_SHARING_CONNECTION_ADDED, DATA_SHARING_CONNECTION_REMOVED, DATASET_SYNC, DEACTIVATE_USER, DOMAIN_BASED_INVITE_CREATED, DOMAIN_BASED_INVITE_REMOVED, DOMAIN_BASED_INVITES_DISABLED, DOMAIN_BASED_INVITES_ENABLED, EMAIL_LOGGING_SYNC_SET_ALL, EMAIL_LOGGING_SYNC_SET_CONTACTS, EMAIL_LOGGING_SYNC_SET_REPLIES, EMAIL_TRACKING_DISABLED, EMAIL_TRACKING_ENABLED, EXPORT, EXPORT_APPROVAL, EXPORT_DOWNLOAD, EXPORT_USERS, FORM_SUBMISSIONS_EXPORT, GDPR_DELETE, GDPR_TOGGLE_DISABLED, GDPR_TOGGLE_ENABLED, HAPIKEY_CREATE, HAPIKEY_DEACTIVATE, HAPIKEY_VIEW, HUBSPOT_EMPLOYEE_ACCESS_DISABLED, HUBSPOT_EMPLOYEE_ACCESS_ENABLED, IMPERSONATE_USER, IMPORT, INSTALL_INTEGRATION, IP_RESTRICTIONS_DISABLED, IP_RESTRICTIONS_ENABLED, JOINED_PORTAL_VIA_DOMAIN_BASED_INVITE, LEGAL_BASIS_REQUIREMENT_DISABLED, LEGAL_BASIS_REQUIREMENT_ENABLED, MANUAL_PASSWORD_RESET_EMAIL_SEND, MANUAL_REGISTRATION_EMAIL_SEND, MARKETING_CONTACTS_APP_SETTINGS_DISABLED, MARKETING_CONTACTS_APP_SETTINGS_ENABLED, MERGE_REVERT, MODIFY_WEBHOOK_IN_WORKFLOW, MULTI_ACCOUNT_REPORTING_CONNECTION_ADDED, MULTI_ACCOUNT_REPORTING_CONNECTION_REMOVED, MULTI_ACCOUNT_WORKFLOWS_CONNECTION_ADDED, MULTI_ACCOUNT_WORKFLOWS_CONNECTION_REMOVED, NEVER_LOG_FOR_PORTAL_ADDITION, NEVER_LOG_FOR_PORTAL_DELETION, NEVER_LOG_FOR_USER_ADDITION, NEVER_LOG_FOR_USER_DELETION, PASSKEY_ADDED, PASSKEY_DELETED, PAYMENT_ACCOUNT_CREATION, PAYMENT_ACCOUNT_INFO_UPDATE, PAYMENT_BANK_ACCOUNT_CHANGE, PAYMENT_ONBOARDING_LINK_SEND, PERSONAL_ACCESS_KEY_CREATE, PERSONAL_ACCESS_KEY_DEACTIVATE, PERSONAL_ACCESS_KEY_ROTATE, PERSONAL_ACCESS_KEY_VIEW, PRIVATE_APP_ACCESS_TOKEN_CREATE, PRIVATE_APP_ACCESS_TOKEN_DEACTIVATE, PRIVATE_APP_ACCESS_TOKEN_ROTATE, PRIVATE_APP_ACCESS_TOKEN_VIEW, PRIVATE_APP_CLIENT_SECRET_VIEW, PRIVATE_APP_CLIENT_SECRET_WRITE, PRIVATE_APP_SCOPE_GROUPS_UPDATE, PRODUCTION_DEPLOYMENT, PROPERTY_HISTORY_REVISION, PUBLIC_APP_CLIENT_SECRET_VIEW, PUBLIC_APP_CLIENT_SECRET_WRITE, REACTIVATE_USER, REMOVE_ADMIN_PERMISSIONS, REMOVE_ADMIN_USER, REMOVE_SINGLE_SIGN_ON, REMOVE_TWO_FACTOR_AUTHENTICATION, REMOVE_USER, REQUIRE_SINGLE_SIGN_ON, RESTRICTED_LIST_ADDED_TO_CONTENT, SANDBOX_CREATION, SANDBOX_DELETION, SANDBOX_SYNC, SANDBOX_SYNC_TO_PRODUCTION, SECRET_ADDED_TO_SERVERLESS_FUNCTION, SENSITIVE_DATA_DISABLED, SENSITIVE_DATA_ENABLED, SEQUENCE_CLONED, SEQUENCE_CREATED, SEQUENCE_ENROLLMENT_INITIATED, SEQUENCE_ENROLLMENT_STATE_CHANGED, SEQUENCE_MODIFIED, SERVICE_KEY_AUTO_ROTATE, SERVICE_KEY_CREATE, SERVICE_KEY_DEACTIVATE, SERVICE_KEY_PERMISSIONS_UPDATE, SERVICE_KEY_REVEAL, SERVICE_KEY_ROTATE, SERVICE_KEY_ROTATION_SCHEDULE_REMOVED, SERVICE_KEY_ROTATION_SCHEDULE_SET, SERVICE_KEY_ROTATION_SCHEDULE_UPDATED, SMTP_TOKEN_CREATED, SMTP_TOKEN_DELETED, SMTP_TOKEN_PASSWORD_RESET, SMTP_TOKEN_RETRIEVED, TEAM_ADDED, TEAM_DELETED, TEAM_USER_ADDED, TEAM_USER_DELETED, TEMPLATE_DELETED, TEMPLATE_MODIFIED, TOUCHLESS_PURCHASE, TWO_FACTOR_PROTECTED_ENDPOINT_BLOCKED, TWO_FACTOR_PROTECTED_ENDPOINT_SUCCEEDED, UNIFIED_RESTORE_UNDO_EXECUTION, UNINSTALL_INTEGRATION, UNREQUIRE_SINGLE_SIGN_ON, WEBHOOK_SETTINGS_UPDATE, WEBHOOK_SUBSCRIPTION_CREATE, WEBHOOK_SUBSCRIPTION_UPDATE
userId	JSON	Required within parent
userId (anyOf 1)	integer	Alternative	The user's unique ID. Format: int32
userId (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Retrieve login activity — response body — paging next

Field	Type	Presence	Description and constraints
$	object	Root	Specifies the paging information needed to retrieve the next set of results in a paginated API response
after	string	Required within parent	A string token used as a cursor to fetch the next set of results in a paged response.
link	string	Optional	A URL string that provides a direct link to the next page of results.

Policy, approvals and errors

SDK function policy ID: hubspot.audit_logs_get_security. Catalog operation: audit_logs_get_security. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Required provider scopes: ["account-info.security.read"]

Official provider source