# How to access API using hubl

**URL:** <https://community.hubspot.com/t/how-to-access-api-using-hubl/90206>\
**Category:** CMS Development\
**Created:** [September 21, 2023, 6:20pm UTC](https://community.hubspot.com/t/how-to-access-api-using-hubl/90206 "2023-09-21T18:20:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jillii](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jillii/32/195472_2.png) [@jillii](https://community.hubspot.com/u/jillii)\
**Post date:** [September 21, 2023, 6:20pm UTC](https://community.hubspot.com/t/how-to-access-api-using-hubl/90206/1 "2023-09-21T18:20:41Z")

</div>

Hello, I am trying to translate the following into hubl, so I can use it in a custom module. What this code does is it gets the current user’s ID to extract data about them. Ultimately I am trying to figure out what Lists the current user is on.

```lia-code-sample
 $user_id = $_COOKIE['hubspotutk'];
 $url = "https://api.hubapi.com/contacts/v1/contact/utk/" . $user_id . "/profile";

 $curl = curl_init();
 curl_setopt($curl, CURLOPT_URL, $url);
 curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
 curl_setopt($curl, CURLOPT_TIMEOUT, 10);
 curl_setopt($curl, CURLOPT_HTTPHEADER, [
 'Authorization: Bearer pat-na1-XXXXX-XXX-XXX-XXXX-XXXXXX',
 'Content-Type: application/json'
 ]);

 $response = curl_exec($curl);
 $data = json_decode($response, true);

```

I’ve removed the autorization code for privacy.

---

<div class="post-metadata">

**Author:** ![Kevin-C](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/kevin-c/32/34570_2.png) [@Kevin-C](https://community.hubspot.com/u/Kevin-C)\
**Post date:** [September 22, 2023, 12:50pm UTC](https://community.hubspot.com/t/how-to-access-api-using-hubl/90206/2 "2023-09-22T12:50:28Z")

</div>

Hey @jillii

So HUBL is a subset of Jinja, which is a templating language. By defenition templating languages do not have the ability to make http request. In your case you’ve got a few options:

- if the user is cookied via form you can use the HUBL {{ contact }} variable to access basic information about the contact like email, name, and id.
- you can use the ID from the above with JS to make an API call to a serverless function or external server to retrieve more data from the contact record

I would also nudge you to check out the available [HUBL functions.](https://developers.hubspot.com/docs/cms/hubl/functions)

Hope this gets you moving!

Best

---

<div class="post-metadata">

**Author:** ![jillii](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jillii/32/195472_2.png) [@jillii](https://community.hubspot.com/u/jillii)\
**Post date:** [September 22, 2023, 12:57pm UTC](https://community.hubspot.com/t/how-to-access-api-using-hubl/90206/3 "2023-09-22T12:57:36Z")

</div>

This is a great answer. My only follow up question is: wouldn’t I need my private app key to access data with an API call - in which case using js would make it available on the frontend? That seems like a huge security risk.. or am I missing something?

---

<div class="post-metadata">

**Author:** ![Kevin-C](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/kevin-c/32/34570_2.png) [@Kevin-C](https://community.hubspot.com/u/Kevin-C)\
**Post date:** [September 22, 2023, 12:59pm UTC](https://community.hubspot.com/t/how-to-access-api-using-hubl/90206/4 "2023-09-22T12:59:54Z")

</div>

@jillii

Yes you would, and this is where the serverless function/lambda comes into play. By running that request in a secure environment that has access to your auth you avoid security issues.

So your flow would be something like:

1. page loads
2. module JS makes request to serverless function
3. serverless function makes authentiated request to hubspot and return the needed data

---

<div class="post-metadata">

**Author:** ![jillii](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jillii/32/195472_2.png) [@jillii](https://community.hubspot.com/u/jillii)\
**Post date:** [January 23, 2024, 2:15pm UTC](https://community.hubspot.com/t/how-to-access-api-using-hubl/90206/5 "2024-01-23T14:15:32Z")

</div>

Aha, that makes sense. Could you please provide an example of that workflow?