> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # HubSpot API > Read and update your HubSpot CRM in an agent: contacts, companies, deals, activities, and a two-way sync with your PSA The agent connects with a HubSpot service key, and each call is limited by the key's scopes and by the permission groups below. Automatically enabled when you configure HubSpot permissions in your agent workflow. ## What it does * Search contacts, companies, deals and the other CRM records by any property, and read what changed since a time * Create and update records, link them to each other, and log notes and tasks on them * Read owners, pipelines, deal stages and properties, which a sync maps values with * Keep contacts and deals in step with your PSA: the agent reads both sides, matches contacts by email and deals by a stored PSA opportunity id or by company and title, writes only the fields that differ, creates a missing record only when a person requests it on that record, and reports each record it could not match or a field both sides changed * Open one PSA ticket or project for each deal that is won or has an accepted quote, once: the agent marks each deal it converted in a deal property and ends each title with the deal's id, so a later run never makes a second one * Reach the rest of HubSpot's API (inbox, commerce, marketing, website, workflows, users) as the permission groups allow. Safety Controls below lists what Neo refuses and what always asks ## Permission groups | Group | Covers | | - | - | | Contacts | Contacts and their associations | | Companies | Companies and their associations | | Deals, Quotes & Products | Deals, leads, line items, products, quotes, goals, deal splits and forecasts | | Notes, Tasks & Activities | Notes, tasks, calls, logged emails, meetings, communications, postal mail, meeting links | | Tickets & Feedback | HubSpot help desk tickets and feedback submissions | | Conversations Inbox | Inbox threads and messages, assignments | | Invoices, Payments & Commerce | Invoices, orders, carts, payments, subscriptions, discounts, fees, taxes, contracts, price books, payment links | | Custom & Other Objects | Custom objects, appointments, courses, listings, services, projects and partner records | | Properties, Pipelines & Schemas | Properties, pipelines and stages, custom object schemas, association labels, owners and limits | | Lists, Imports, Exports & Events | Lists and their members, imports, exports, custom events and data sources | | Marketing, Website & Files | Marketing emails, campaigns, forms, marketing events, subscriptions, pages, blogs, HubDB, files, URL redirects | | Workflows & Sequences | Workflows, sequences and enrollments | | Account, Users & Reports | Account details, users, teams, business units, currencies, reports and dashboards | | Apps, Webhooks & Extensions | Webhooks, app settings, custom channels, calling and video extensions, timeline events, custom workflow actions, feature flags. Most of these belong to a HubSpot developer app and take that app's id | Each group can be Disabled, Read Only or Read / Write. Linking two records needs the groups of both; linking a note or a task to a record follows the approval setting of Notes, Tasks & Activities. | Profile | What it does | | - | - | | Read Only | Reads every group, changes nothing | | Helpdesk | Logs notes and tasks and works HubSpot tickets on its own. Changes to contacts, companies and deals, and inbox replies, ask a technician first. Every other group is read only | | IT Admin | Changes on its own, except workflows and apps, which ask a technician first, and the changes Safety Controls lists | | Full Automation | Every change with no approval, except those Safety Controls lists | ## Safety Controls These always ask a technician, whatever the profile: * Deleting, archiving or merging a company * A GDPR delete of any CRM record or a file, which cannot be undone * Every change to users and teams, and to the owners or sharing of reports and dashboards * Every change to apps, webhooks and extensions, which send your data to an outside app * Retrying a payment, which charges the client's card * Changing pipeline rules, which set who may move or edit records at each stage * Deleting a custom object schema, a pipeline or an association definition * Subscribing a contact to email, or setting a subscription to subscribed * Any change that records an approval decision in HubSpot, such as setting a quote to approved, rejected or approval not needed Neo never calls HubSpot's OAuth token endpoints, the chat visitor identification token, the transactional email SMTP tokens or contact preference links, because each returns or changes a credential. ## Setup See [Connecting HubSpot to Neo](/integrations/hubspot/connecting-to-neo). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.