topic Re: How to connect to the Open API Sandbox in APIs & Integrations

How to connect to the Open API Sandbox

JohnDanter — Tue, 02 Dec 2025 14:50:40 GMT

Hi guys

I am a JD Edwards developer and wish to start testing the sandbox APIs to see what data I can get out of and up into Hubspot.

Usually in other cases like this we are given a demo user and password and a sandbox url with which to get a token etc and then call the APIs

But I would also like to call these APIs from my JDE system, so to do this we need an Open API connnection. This then shows me ALL the APIs in that library

Or call even these APIs from Postman

Has anyone done this before?

Thanks

John

Re: How to connect to the Open API Sandbox

SamTassey — Tue, 02 Dec 2025 15:57:09 GMT

Hi @JohnDanter! Welcome to the community!

I see you're looking to use API to read and write data with HubSpot. I'd recommend starting with our main Developer Documentation here! https://developers.hubspot.com/docs/api-reference/overview. This will outline all syncable data and available endpoints!

For information on creating an additional environment outside of a standard HubSpot Account, here is our documentation detailing Sandbox setup and developer account creation!

Additionally, I'm going to loop in a few of our experts in case they have any additional suggestions!

@RubenBurdin, @SteveHTM, @evaldas, and @GRajput!

Re: How to connect to the Open API Sandbox

d-lupo — Wed, 03 Dec 2025 15:32:21 GMT

Hi @JohnDanter,

Yes, in HubSpot you can test and use the APIs via Private App tokens, which also seems to be the easiest approach for your use case.

Here's how to create a private app:

In HubSpot, go to Settings.
In the left navigation, open Integrations → Legacy apps.
Create a Private App and grant whatever scopes/permissions you need for the endpoints you want to call.
Once the app is created, go to the Auth tab. You'll see an Access Token there.

You can use that token directly in Postman by adding an Authorization header like:

Authorization: Bearer <access_token>

Also worth noting: Private Apps and the HubSpot APIs are available on free HubSpot accounts, so you can work with them even if you're developing against a free portal. Just be aware that some endpoints/features may be limited depending on the free plan's access to certain functionality, so you might hit restrictions for objects or actions that require paid tiers.

For the full API reference and endpoint list, see here: API Reference Overview - HubSpot docs

Did my post resolve your question? If so, please consider marking it as the accepted solution to help others in the community.

Kind regards
Dennis

Re: How to connect to the Open API Sandbox

JohnDanter — Thu, 04 Dec 2025 10:23:33 GMT

Thank you so much for this!!

Ok so now I have a very basic app and can see my token in the app Auth > Access token 🙂

This now works in Postman, theirs and mine and from JDE 🙂

Re: How to connect to the Open API Sandbox

JohnDanter — Thu, 04 Dec 2025 14:09:28 GMT

One other question 🙂

I will be connecting to hubpsot from an external system who maybe updating and adding hubspot data. I would like to know who did that. So I am guessing I need a token per user

What I have setup and gt working so far is a token I obtained from inside hubspot.

How dod I get a token per external user so hubspot knows who the external user is making the updates?

JWTs? Can I request a token for specific users from outside

Thanks

John

Re: How to connect to the Open API Sandbox

SamTassey — Wed, 10 Dec 2025 16:56:39 GMT

Hi @JohnDanter,

Thanks for sharing your update and the resolution. Your feedback helps the community and others facing similar issues!

As for your question on pulling the change source of the data, you may find this thread helpful - https://community.hubspot.com/t5/128172-RevOps-Discussions/How-to-use-Change-Source-data-in-workflows-and-reports/m-p/1110893

It appears that @IohranAraujo states there are current limitations around this. However, I'm going to loop in a few other experts here to see if they have any suggestions for you.

@d-lupo, @RubenBurdin, @SteveHTM, @evaldas, Do you have any suggestions for what @JohnDanter is trying to accomplish here?

Thank you!

Sam, Community Manager

Re: How to connect to the Open API Sandbox

RubenBurdin — Mon, 15 Dec 2025 19:23:06 GMT

Hi @JohnDanter , you’ve already uncovered the key piece: HubSpot doesn’t work like a traditional “one token per user” API model when you’re using private apps.

With private app tokens, all API actions are attributed to the app itself, not to individual external users. That’s by design. HubSpot will show the change source as “API” or the app name, but it won’t identify which external user inside JDE triggered the update. There’s no supported way to mint per-user tokens, JWTs, or impersonation-style access for private apps.

If you truly need user-level attribution inside HubSpot, the only supported path is OAuth-based public apps. With OAuth, each HubSpot user authorizes the app, and actions can be associated with that user’s authorization context. Even then, attribution is limited, and many CRM updates still show up generically as “via API.” HubSpot documents the OAuth flow and its limits here (https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/oauth/oauth-quickstart-guide )

In practice, most teams solve this by pushing their own metadata along with the update. For example, store the external user ID or username in a custom property like “Last updated by (external)” or include it in a note or timeline event. That way, you preserve traceability without fighting HubSpot’s auth model. HubSpot’s native “change source” and “updated by” fields won’t reliably reflect external system users today, and that’s a known limitation.

So your current setup is correct and future-proof: one private app token for sandbox and production, scoped appropriately, and your own audit trail if you need per-user visibility.

Re: How to connect to the Open API Sandbox

JohnDanter — Tue, 16 Dec 2025 08:12:11 GMT

Thank you so much much for this information Ruben.

I guess data up from JDE to Hubspot can work the way you have suggested yes (metadata of who did what) but my real issue will be the other way around. Hubspot updates down into JDE.

For this path I will need to know who is doing what yes, but again metadata could work there, it's just I need the equivelant JDE User Id coming in from Hubspot.

So Hubspot will need a way to link accounts to JDE User accounts. I'll figure it out 🙂

Thanks again

Re: How to connect to the Open API Sandbox

GRajput — Wed, 07 Jan 2026 11:56:53 GMT

Hi @JohnDanter

"To use the HubSpot APIs, it is recommended to create a private app and assign it the required OAuth scopes for the APIs you intend to access. The private app will generate an access token that can be used to authenticate API requests. Refer to the HubSpot CRM API documentation here: https://developers.hubspot.com/docs/guides/crm/understanding-the-crm

to identify the endpoints and required scopes for each endpoint. Ensure these scopes are included in your private app configuration. Once configured, you can use the access token to make API calls programmatically or via tools like Postman. This setup provides a secure and scoped mechanism to interact with HubSpot APIs.