Set up a HubSpot connector

Capabilities

Resource	Sync	Provision	Lifecycle actions
Accounts
Teams
Roles*
Users

*HubSpot roles are only supported on the free or higher versions of Marketing Hub, Sales Hub, Service Hub, and Content Hub. Role syncing and provisioning via this connector are not available when using any other HubSpot product or version.

Provisioning

C1 can provision access in HubSpot using this connector. Provisioning requires the settings.users.write scope on the private app (see the credentials steps below) and that the connector runs with provisioning enabled (BATON_PROVISIONING=true when self-hosted).

Operation	Supported	Notes
Grant / revoke a Role	Yes	Assigns or clears the user’s role. The Super Admin role cannot be assigned through the HubSpot API.
Grant a Team membership (primary or secondary)	Yes	Adds the user to the team as a primary or secondary member.
Revoke a primary Team membership	Yes
Revoke a secondary Team membership	No	The HubSpot API does not support removing a secondary team membership. Remove it manually in HubSpot.
Create a User account	Yes	Invites the user to the HubSpot portal by email. No password is set — the user completes setup from the invitation email.
Delete a User account	Yes	Removes the user from the HubSpot portal.

HubSpot provides no API to re-enable a deactivated user. To restore access for a user who was deactivated in HubSpot, delete the account and re-invite it. This creates a new account and does not preserve the previous user’s history.

Deactivated HubSpot users continue to appear in C1 with their existing entitlement grants, because the account still exists in HubSpot. Enable user status syncing (see the configuration steps below) to have these users flagged as disabled in C1.

Gather HubSpot credentials

Configuring the connector requires you to pass in credentials generated in HubSpot. Gather these credentials before you move on.

A user with the Super admin role in HubSpot must perform this task.

Create a private app and generate an access token

Log into HubSpot and navigate Settings > Private Apps.

Click Create a private app

On the Basic info tab, enter a name (such as “C1”) and description for the new app.

On the Scopes tab, select the following scopes:In the Settings area:

settings.users - Read
settings.users.teams - Read

In the Standard area:

account-info.security.read - Request
integration-sync - Request
oauth - Request

Optional. If you want to use C1 to provision users (invite, deactivate) or manage team/role membership, add settings.users.write.

Optional. To sync user status, search for and add the crm.objects.users.read scope to the app.

Click Create app and confirm your action.

The new private app’s token is shown. Carefully copy and save the token.

That’s it! Next, move on to the connector configuration instructions.

Configure the HubSpot connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in C1
Access to the set of HubSpot credentials generated by following the instructions above

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Apps > Connectors and click Add connector.

Search for HubSpot and click Add.

Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

Find the Settings area of the page and click Edit.

Paste the private app access token into the Access Token field.

Optional. If you want to sync user statuses from Hubspot, click to Enable user status.This option requires the crm.objects.users.read scope, so make sure you’ve added it to your private app before you proceed.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your HubSpot connector is now pulling access data into C1.

Follow these instructions to use the Hubspot connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new HubSpot connector

In C1, navigate to Apps > Connectors and click Add connector.

Search for Baton and click Add.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your HubSpot connector deployment:

Secrets configuration

# baton-hubspot-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-hubspot-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>
  
  # HubSpot credentials
  BATON_TOKEN: <HubSpot private access token>

  # Optional: include if you want to sync user statuses (requires the crm.objects.users.read scope on the private app)
  BATON_USER_STATUS: true

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-hubspot.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-hubspot
  labels:
    app: baton-hubspot
spec:
  selector:
    matchLabels:
      app: baton-hubspot
  template:
    metadata:
      labels:
        app: baton-hubspot
        baton: true
        baton-app: hubspot
    spec:
      containers:
      - name: baton-hubspot
        image: public.ecr.aws/conductorone/baton-hubspot:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-hubspot
        envFrom:
        - secretRef:
            name: baton-hubspot-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the HubSpot connector to. HubSpot data should be found on the Entitlements and Accounts tabs.

That’s it! Your HubSpot connector is now pulling access data into C1.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a HubSpot connector

Capabilities

Provisioning

Gather HubSpot credentials

Create a private app and generate an access token

Configure the HubSpot connector

Resources

Step 1: Set up a new HubSpot connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

​Capabilities

​Provisioning

​Gather HubSpot credentials

​Create a private app and generate an access token

​Configure the HubSpot connector

​Resources

​Step 1: Set up a new HubSpot connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Provisioning

Gather HubSpot credentials

Create a private app and generate an access token

Configure the HubSpot connector

Resources

Step 1: Set up a new HubSpot connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector