HubSpot: Audit logs schemas

← Audit logs operations · All schemas

Retrieve audit logs — audit Logs get Audit Logs — response body

Field	Type	Presence	Description and constraints
$	object	Root
paging	Model	Optional	Expand Retrieve login activity — response body — paging
results	array	Required within parent	An array of user action events, each represented by a PublicApiUserActionEvent object.
results[]	Model	Each item	Expand Retrieve audit logs — audit Logs get Audit Logs — response body — results item

Referenced models: Retrieve login activity — response body — paging, Retrieve audit logs — audit Logs get Audit Logs — response body — results item

Retrieve audit logs — audit Logs get Audit Logs — response body — results item

Field	Type	Presence	Description and constraints
$	object	Root
actingUser	Model	Required within parent	Expand Retrieve audit logs — audit Logs get Audit Logs — response body — results item acting User
action	string	Required within parent	The type of action taken.
category	string	Required within parent	The category of the activity.
id	string	Required within parent	The login activity's unique ID.
occurredAt	string	Required within parent	The time that the action occurred at. Format: date-time
subCategory	string	Optional	The subcategory of the activity.
targetObjectId	string	Optional	The ID of the impacted object.

Referenced models: Retrieve audit logs — audit Logs get Audit Logs — response body — results item acting User

Retrieve audit logs — audit Logs get Audit Logs — response body — results item acting User

Field	Type	Presence	Description and constraints
$	object	Root
userEmail	string	Optional	The email address of the user who performed the action.
userId	JSON	Required within parent
userId (anyOf 1)	integer	Alternative	The user's unique ID. Format: int32
userId (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Retrieve login activity — response body

Field	Type	Presence	Description and constraints
$	object	Root
paging	Model	Optional	Expand Retrieve login activity — response body — paging
results	array	Required within parent	An array of PublicLoginAudit objects, each representing a single login audit event.
results[]	Model	Each item	Expand Retrieve login activity — response body — results item

Referenced models: Retrieve login activity — response body — paging, Retrieve login activity — response body — results item

Retrieve login activity — response body — paging

Field	Type	Presence	Description and constraints
$	object	Root	Paging information for forward-only pagination. Contains the next page reference when more results are available; omitted or empty on the last page.
next	Model	Optional	Expand Retrieve login activity — response body — paging next

Referenced models: Retrieve login activity — response body — paging next

Retrieve login activity — response body — paging next

Field	Type	Presence	Description and constraints
$	object	Root	Specifies the paging information needed to retrieve the next set of results in a paginated API response
after	string	Required within parent	A string token used as a cursor to fetch the next set of results in a paged response.
link	string	Optional	A URL string that provides a direct link to the next page of results.

Retrieve login activity — response body — results item

Field	Type	Presence	Description and constraints
$	object	Root
countryCode	string	Optional	The approximate country code of the login
email	string	Optional	Email address of the user associated with the login.
id	string	Required within parent	The login activity's unique ID.
ipAddress	string	Optional	IP address where the activity originated.
location	string	Optional	The approximate location where the login activity originated.
loginAt	string	Required within parent	The time the login took place. Format: date-time
loginSucceeded	boolean	Required within parent	Whether the login was successful or not.
regionCode	string	Optional	The approximate region code of the login
userAgent	string	Optional	Information about the device used for logging in.
userId	JSON	Optional
userId (anyOf 1)	integer	Alternative	The user's unique ID. Format: int32
userId (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Retrieve security history — response body

Field	Type	Presence	Description and constraints
$	object	Root
paging	Model	Optional	Expand Retrieve login activity — response body — paging
results	array	Required within parent	An array of hydrated critical actions, each containing detailed information about a specific critical action.
results[]	Model	Each item	Expand Retrieve security history — response body — results item

Referenced models: Retrieve login activity — response body — paging, Retrieve security history — response body — results item

Retrieve security history — response body — results item

Field	Type	Presence	Description and constraints
$	object	Root
actingUser	string	Optional	Email address of the user associated with the activity.
countryCode	string	Optional	The approximate country code
createdAt	string	Required within parent	The time the activity took place. Format: date-time
id	string	Required within parent	The activity's unique ID.
infoUrl	string	Optional	A link to the URL where the action was taken in the account.
ipAddress	string	Optional	IP address where the activity originated.
location	string	Optional	The approximate location where the activity took place.
objectId	string	Optional	The ID of the affected object.
regionCode	string	Optional	The approximate region code
type	string	Required within parent	The type of activity. Known values: ACCEPTANCE_TEST, ACCOUNT_ADDED_TO_MULTI_ACCOUNT_ORGANIZATION, ACCOUNT_REMOVED_FROM_MULTI_ACCOUNT_ORGANIZATION, ADD_ADMIN_PERMISSIONS, ADD_ADMIN_USER, ADD_SINGLE_SIGN_ON, ADD_TWO_FACTOR_AUTHENTICATION, ADD_USER, ADD_WEBHOOK_IN_WORKFLOW, ALLOWED_GEOLOCATIONS_DISABLED, ALLOWED_GEOLOCATIONS_ENABLED, ALLOWED_LOGIN_METHODS_DELETE, ALLOWED_LOGIN_METHODS_UPDATE, ATTACHMENT_LOGGING_DISABLED, ATTACHMENT_LOGGING_ENABLED, AUTOMATED_INACTIVE_USER_DEACTIVATION_DISABLED, AUTOMATED_INACTIVE_USER_DEACTIVATION_ENABLED, BOTS_WEBHOOK_POST, BOTS_WEBHOOK_UPDATE, BOTS_WEBHOOK_VIEWED, BULK_EMAIL_DOMAIN_CHANGE, CHANGE_AD_EVENT_CONSENT_SETTING, CHANGE_AD_EVENT_DATA_SHARING_SETTING, CHANGE_PASSWORD, CHANNEL_SENSITIVE_DATA_DISABLED, CHANNEL_SENSITIVE_DATA_ENABLED, CONTACT_DATA_EXPORT, CONTACT_OWNER_AUTO_ASSIGN_DISABLED, CONTACT_OWNER_AUTO_ASSIGN_ENABLED, DATA_ACCESS_REQUEST_SUBMITTED, DATA_BACKUP_CREATED, DATA_BACKUP_DOWNLOADED, DATA_BACKUP_SCHEDULE_CREATED, DATA_BACKUP_SCHEDULE_DELETED, DATA_BACKUP_SCHEDULE_UPDATED, DATA_RESTORE_COMPLETED, DATA_SHARING_CONNECTION_ADDED, DATA_SHARING_CONNECTION_REMOVED, DATASET_SYNC, DEACTIVATE_USER, DOMAIN_BASED_INVITE_CREATED, DOMAIN_BASED_INVITE_REMOVED, DOMAIN_BASED_INVITES_DISABLED, DOMAIN_BASED_INVITES_ENABLED, EMAIL_LOGGING_SYNC_SET_ALL, EMAIL_LOGGING_SYNC_SET_CONTACTS, EMAIL_LOGGING_SYNC_SET_REPLIES, EMAIL_TRACKING_DISABLED, EMAIL_TRACKING_ENABLED, EXPORT, EXPORT_APPROVAL, EXPORT_DOWNLOAD, EXPORT_USERS, FORM_SUBMISSIONS_EXPORT, GDPR_DELETE, GDPR_TOGGLE_DISABLED, GDPR_TOGGLE_ENABLED, HAPIKEY_CREATE, HAPIKEY_DEACTIVATE, HAPIKEY_VIEW, HUBSPOT_EMPLOYEE_ACCESS_DISABLED, HUBSPOT_EMPLOYEE_ACCESS_ENABLED, IMPERSONATE_USER, IMPORT, INSTALL_INTEGRATION, IP_RESTRICTIONS_DISABLED, IP_RESTRICTIONS_ENABLED, JOINED_PORTAL_VIA_DOMAIN_BASED_INVITE, LEGAL_BASIS_REQUIREMENT_DISABLED, LEGAL_BASIS_REQUIREMENT_ENABLED, MANUAL_PASSWORD_RESET_EMAIL_SEND, MANUAL_REGISTRATION_EMAIL_SEND, MARKETING_CONTACTS_APP_SETTINGS_DISABLED, MARKETING_CONTACTS_APP_SETTINGS_ENABLED, MERGE_REVERT, MODIFY_WEBHOOK_IN_WORKFLOW, MULTI_ACCOUNT_REPORTING_CONNECTION_ADDED, MULTI_ACCOUNT_REPORTING_CONNECTION_REMOVED, MULTI_ACCOUNT_WORKFLOWS_CONNECTION_ADDED, MULTI_ACCOUNT_WORKFLOWS_CONNECTION_REMOVED, NEVER_LOG_FOR_PORTAL_ADDITION, NEVER_LOG_FOR_PORTAL_DELETION, NEVER_LOG_FOR_USER_ADDITION, NEVER_LOG_FOR_USER_DELETION, PASSKEY_ADDED, PASSKEY_DELETED, PAYMENT_ACCOUNT_CREATION, PAYMENT_ACCOUNT_INFO_UPDATE, PAYMENT_BANK_ACCOUNT_CHANGE, PAYMENT_ONBOARDING_LINK_SEND, PERSONAL_ACCESS_KEY_CREATE, PERSONAL_ACCESS_KEY_DEACTIVATE, PERSONAL_ACCESS_KEY_ROTATE, PERSONAL_ACCESS_KEY_VIEW, PRIVATE_APP_ACCESS_TOKEN_CREATE, PRIVATE_APP_ACCESS_TOKEN_DEACTIVATE, PRIVATE_APP_ACCESS_TOKEN_ROTATE, PRIVATE_APP_ACCESS_TOKEN_VIEW, PRIVATE_APP_CLIENT_SECRET_VIEW, PRIVATE_APP_CLIENT_SECRET_WRITE, PRIVATE_APP_SCOPE_GROUPS_UPDATE, PRODUCTION_DEPLOYMENT, PROPERTY_HISTORY_REVISION, PUBLIC_APP_CLIENT_SECRET_VIEW, PUBLIC_APP_CLIENT_SECRET_WRITE, REACTIVATE_USER, REMOVE_ADMIN_PERMISSIONS, REMOVE_ADMIN_USER, REMOVE_SINGLE_SIGN_ON, REMOVE_TWO_FACTOR_AUTHENTICATION, REMOVE_USER, REQUIRE_SINGLE_SIGN_ON, RESTRICTED_LIST_ADDED_TO_CONTENT, SANDBOX_CREATION, SANDBOX_DELETION, SANDBOX_SYNC, SANDBOX_SYNC_TO_PRODUCTION, SECRET_ADDED_TO_SERVERLESS_FUNCTION, SENSITIVE_DATA_DISABLED, SENSITIVE_DATA_ENABLED, SEQUENCE_CLONED, SEQUENCE_CREATED, SEQUENCE_ENROLLMENT_INITIATED, SEQUENCE_ENROLLMENT_STATE_CHANGED, SEQUENCE_MODIFIED, SERVICE_KEY_AUTO_ROTATE, SERVICE_KEY_CREATE, SERVICE_KEY_DEACTIVATE, SERVICE_KEY_PERMISSIONS_UPDATE, SERVICE_KEY_REVEAL, SERVICE_KEY_ROTATE, SERVICE_KEY_ROTATION_SCHEDULE_REMOVED, SERVICE_KEY_ROTATION_SCHEDULE_SET, SERVICE_KEY_ROTATION_SCHEDULE_UPDATED, SMTP_TOKEN_CREATED, SMTP_TOKEN_DELETED, SMTP_TOKEN_PASSWORD_RESET, SMTP_TOKEN_RETRIEVED, TEAM_ADDED, TEAM_DELETED, TEAM_USER_ADDED, TEAM_USER_DELETED, TEMPLATE_DELETED, TEMPLATE_MODIFIED, TOUCHLESS_PURCHASE, TWO_FACTOR_PROTECTED_ENDPOINT_BLOCKED, TWO_FACTOR_PROTECTED_ENDPOINT_SUCCEEDED, UNIFIED_RESTORE_UNDO_EXECUTION, UNINSTALL_INTEGRATION, UNREQUIRE_SINGLE_SIGN_ON, WEBHOOK_SETTINGS_UPDATE, WEBHOOK_SUBSCRIPTION_CREATE, WEBHOOK_SUBSCRIPTION_UPDATE
userId	JSON	Required within parent
userId (anyOf 1)	integer	Alternative	The user's unique ID. Format: int32
userId (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$