# Prepare a HubSpot contact read

Use this checklist to connect one customer's HubSpot account and read up to ten contacts with `GET /crm/contacts` (`contactsAll`). This task does not create or update records. Send this page to the customer's administrator before asking them to authorize the connection.

The checklist is specific to **CRM → HubSpot → List contacts**. Its [Markdown version](/guides/hubspot-contact-read.md) contains the same requirements. Language changes the example you open next, not the permissions listed here.

## Who does what

| Owner                     | Action                                                                                                                                  | Result to verify                                                                       |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| Application developer     | Select the customer's consumer and HubSpot service. Check [contact coverage](/apis/crm/coverage?resources=contacts&connectors=hubspot).                     | List contacts is available for the selected connector; field coverage meets your task. |
| Application administrator | Review the [HubSpot connector configuration](/apis/crm/hubspot/configuration), including your OAuth application if you supply your own. | The app configuration and requested consent scopes agree.                              |
| Customer administrator    | Open the developer-provided Vault session or hosted Vault Link and authorize the intended HubSpot account.                              | The portal/account is the one the developer should read.                               |
| Application developer     | Check the connection on your backend, then make the bounded contact read.                                                               | Successful response from the intended service and customer; inspect any next cursor.   |

## Check permissions before inviting the customer

HubSpot documents `crm.objects.contacts.read` for contact reads. That provider permission alone does **not** establish a complete Apideck connection configuration.

The [Apideck HubSpot configuration guide](/apis/crm/hubspot/configuration) currently lists these OAuth app scopes:

- `crm.objects.owners.read`
- `crm.objects.contacts.read`
- `crm.objects.contacts.write`
- `crm.objects.companies.read`
- `crm.objects.companies.write`
- `crm.objects.deals.read`
- `crm.objects.deals.write`

This is a connector-configuration list, not a claim that listing contacts requires every permission individually. In particular, a read-only example does not make the underlying OAuth grant read-only. Do not remove scopes from your app configuration based only on this task. If your policy forbids the broader grant, stop and confirm a supported configuration with the connector owner before authorization.

Source review: 12 October 2026. Check the current configuration guide and [HubSpot's scope documentation](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/scopes) before changing a production app. Operation-to-permission minimization and your actual grant still require confirmation; this page does not certify either.

## Connect the correct customer

1. Create a [Vault session](/guides/vault) on your backend for that customer's consumer. Keep the API key and consumer mapping on your server.
2. Give the customer the session or its hosted Vault Link. The customer completes the provider consent; they do not send their HubSpot password or OAuth secret to an agent.
3. After authorization, check [Get connection](/apis/vault/reference/connections#connectionsOne) for the intended consumer, CRM API and HubSpot service. Closing Vault is not proof of a successful connection.

**You now have:** a connection to check and use. The shared checklist URL does not contain its credentials or customer identifiers.

## Make and verify the read

[Open the HubSpot first-call example](/first-api-call?api=crm&connector=hubspot&useCase=customer-sync). Choose your language there, or continue with the language carried from your previous page. Follow the example's limit of ten records.

Confirm the selected customer and HubSpot account, the response status, record count and pagination cursor. An empty successful page can be valid; it is not automatically a permissions failure. A next cursor means you have read only part of the collection.

**Success:** the expected account was read and the result was inspected. Continue to the [CRM contact importer](/guides/crm-contact-sync?api=crm&connector=hubspot&useCase=customer-sync) for pagination and durable storage.

## If setup or the read fails

- **Consent reports insufficient scopes:** the application administrator compares the OAuth app configuration with the scopes requested by the connector. Repeatedly asking the customer to click Authorize will not fix a configuration mismatch.
- **Apideck authentication fails:** the developer checks application credentials and the customer/consumer mapping locally. Never paste secrets into a support message or agent prompt.
- **Provider permission failure:** inspect the connection and [parent/child logs](/logs?api=crm&connector=hubspot&useCase=customer-sync), then have the administrator correct access and reconnect if required. Retry the read only after correcting the cause.
- **The account is wrong or coverage is insufficient:** stop. Do not silently switch customers or assume a similar operation is equivalent.

For a complete diagnosis example, follow [a failed read from evidence to recovery](/guides/investigate-failed-request).