HubSpot Files
Browse all Hubapi APIs★ Only Publicly Available OpenAPI DocumentStorageObject StorageapiKey, oauth218 EndpointsREST
For Agents
Upload, search, replace, and delete files in the HubSpot file manager, plus manage folders, signed URLs, and asynchronous URL imports.
Use for: I need to upload a PDF report to the HubSpot file manager, Import an image from a URL into HubSpot asynchronously, Search for files in HubSpot by name, Generate a signed URL to share a private HubSpot file
Not supported: Does not store CRM contact records, send marketing emails, or manage CMS pages — use only for HubSpot file manager uploads, folders, and signed URLs.
Jentic publishes the only available OpenAPI specification for HubSpot Files, keeping it validated and agent-ready. The HubSpot Files API manages the file manager attached to a HubSpot portal — uploading binary files, importing from URLs, organising them into folders, generating signed URLs for private files, and handling GDPR deletion. Files stored here are referenced by HubSpot CMS pages, marketing emails, and CRM records, so the API is the integration surface whenever an agent or app needs to put assets into the HubSpot ecosystem.
Install Jentic One Beta
Connect the Files to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Files, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Files API.
Upload a binary file to HubSpot via POST /files/v3/files
Import a file from a public URL asynchronously through /files/v3/files/import-from-url/async and check its task status
Search files and folders by name, type, and folder via /files/v3/files/search and /files/v3/folders/search
Replace a file in place with PUT /files/v3/files/{fileId} so existing references remain valid
Generate a signed URL for a private file through GET /files/v3/files/{fileId}/signed-url
Create, update, and delete folders, including async folder property updates
GDPR-delete a file via DELETE /files/v3/files/{fileId}/gdpr-delete
Use Cases
Patterns agents use Files API for, with concrete tasks.
★ Sync Marketing Assets into HubSpot
Upload product images, datasheets, or branded PDFs into the HubSpot file manager so they can be referenced in CMS pages and marketing emails. POST /files/v3/files accepts multipart uploads; /files/v3/files/import-from-url/async pulls assets from existing URLs without proxying through the agent.
POST a PDF datasheet to /files/v3/files with folderPath /marketing/datasheets and confirm a 201 response with the file URL.
Replace Files Without Breaking References
When a marketing PDF or image needs an updated version, PUT /files/v3/files/{fileId} replaces the binary in place. Existing CMS pages and email links keep working because the file ID and URL stay the same. This is faster and safer than uploading a fresh file and rewriting references.
PUT the new datasheet PDF to /files/v3/files/9876543210 to replace the existing file binary while preserving its public URL.
GDPR-Compliant File Deletion
Honour data subject deletion requests by calling DELETE /files/v3/files/{fileId}/gdpr-delete, which permanently removes the file and prevents recovery. This is the compliant path versus DELETE /files/v3/files/{fileId}, which is a soft delete only.
DELETE /files/v3/files/{fileId}/gdpr-delete for every file referenced by the deletion-request user record.
AI Agent File Storage via Jentic
An AI agent that generates a report PDF or image asset uses Jentic to upload it into HubSpot's file manager and then references the returned URL in a marketing email or CMS page — without juggling HubSpot OAuth flows in the agent code.
Search Jentic for upload a file to hubspot, load POST /files/v3/files, and execute with the binary and folderPath /agents/output.
Key Endpoints
18 endpoints — jentic publishes the only available openapi specification for hubspot files, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/files/v3/files
Upload a file
POST
/files/v3/files/import-from-url/async
Import a file from a URL asynchronously
GET
/files/v3/files/search
Search files
PUT
/files/v3/files/{fileId}
Replace a file in place
GET
/files/v3/files/{fileId}/signed-url
Get a signed URL for a private file
DELETE
/files/v3/files/{fileId}/gdpr-delete
GDPR-delete a file permanently
POST
/files/v3/folders
Create a folder
GET
/files/v3/folders/search
Search folders
POST
/files/v3/files
Upload a file
POST
/files/v3/files/import-from-url/async
Import a file from a URL asynchronously
GET
/files/v3/files/search
Search files
PUT
/files/v3/files/{fileId}
Replace a file in place
GET
/files/v3/files/{fileId}/signed-url
Get a signed URL for a private file
DELETE
/files/v3/files/{fileId}/gdpr-delete
GDPR-delete a file permanently
POST
/files/v3/folders
Create a folder
GET
/files/v3/folders/search
Search folders
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
HubSpot hapikeys, OAuth tokens, and private-app tokens are stored encrypted in the Jentic vault and injected per call. Agents only receive scoped execution access, never the raw secret.
Intent-based discovery
Agents search Jentic with intents like upload a file to hubspot or get a signed url for a hubspot file and Jentic returns the matching /files/v3 endpoints with input schemas.
Time to first call
Direct integration: 4-8 hours including OAuth scope wiring, async polling, and signed-URL handling. Through Jentic: under 1 hour for the API calls themselves.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Files API through Jentic.
Why is there no official OpenAPI spec for HubSpot Files?
HubSpot does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Files via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the HubSpot Files API use?
Files supports HubSpot hapikey (query), OAuth 2.0 authorization code with the files or files.ui_hidden.read scopes, and private-app legacy tokens (private-app-legacy header). Through Jentic, the configured credential is stored encrypted and injected at call time.
Can I import a file from a public URL instead of uploading bytes?
Yes. POST to /files/v3/files/import-from-url/async with the source URL; HubSpot fetches the file in the background. Poll /files/v3/files/import-from-url/async/tasks/{taskId}/status to confirm completion.
What are the rate limits for the HubSpot Files API?
Files inherits HubSpot's standard rate limits — typically 100 requests / 10 seconds for hapikey, higher under OAuth on Enterprise. File size limits depend on plan tier and are enforced at upload time with a 4xx response.
How do I get a private file URL I can share through Jentic?
Search Jentic for get a signed url for a hubspot file, load GET /files/v3/files/{fileId}/signed-url, and execute with the fileId. Jentic returns the time-limited signed URL the recipient can use without HubSpot credentials.
What is the difference between DELETE and gdpr-delete?
DELETE /files/v3/files/{fileId} performs a soft delete that can be reversed. DELETE /files/v3/files/{fileId}/gdpr-delete permanently removes the file and is the correct call for data-subject deletion requests.
GET STARTED