HubSpot app-level webhook (public)
POST/api/hubspot/webhook
ONE url for every installed account (doc 93 §3.1). Trust is
X-HubSpot-Signature-v3 (base64 HMAC-SHA256 of method + uri + body +
timestamp, keyed by the app secret) with X-HubSpot-Request-Timestamp
no older than five minutes. Each event names its account (portalId);
a changed contact's link goes stale so the card reads it fresh. Each
event is processed once. An unknown account is acknowledged.
Request
Responses
- 200
- 403
Accepted; received counts the events processed.
Bad or stale signature.