🚀 March 2026 API Rollup! Highlights:
🗓️ New date-based versioning (/YYYY-MM/)
📊 File Ingestion API (beta) for Data Studio
💬 Conversations API enhancements (incl. LLM actor ticket associations
🎥 DX insights from our Postman event
Explore more here: postman.com/hubspot/hubspot-…
OAuth looks simple — until production.
Then it’s about expiring tokens, refresh under load, multi-tenant isolation, and monitoring.
@TechWithHannah shares production-ready OAuth token patterns for @HubSpot integrations → bit.ly/3YDKhug
New @HubSpotDev#API updates just dropped on our @getpostman workspace 🚀
IP Ranges API, better list filtering, CPQ template selection, GA app uninstall more.
🔗 postman.com/hubspot/hubspot-…
HubSpot Devs: what are you most excited about?👀
🚀 Quick Survey: Help Improve HubSpot’s Public API Workspace on @getpostman !
We’re launching a 1-min Dev Experience Survey to hear how you use our Postman workspace. What’s great? What’s confusing? What needs fixing?
👉 Survey: hsdev.fyi/postman-hubspot-pa…#api#postman#hubspot
🚨 October 2025 @HubSpotDev#API Rollup… arriving in November?! No worries, our API changelogs tend to make a dramatic entrance.
See everything on our @getpostman workspace! Good things come to those who wait (and wait)! 😂 (sorry, I was moving!) 🔗postman.com/hubspot/hubspot-…
💡 Webhooks & custom workflow actions unlock new levels on the @HubSpot Developer Platform.
@TechWithHannah breaks down how to extend automations, call custom APIs & connect workflows with the structure and control of a modern, file-based framework.
➡️ bit.ly/49kh2Di
How do we design secure and safe APIs?
The rise in API-related security breaches highlights the necessity for robust API security.
Let’s look at 12 essential tips for improving API security:
𝗥𝗮𝘁𝗲 𝗹𝗶𝗺𝗶𝘁𝗶𝗻𝗴 𝗮𝗻𝗱 𝘁𝗵𝗿𝗼𝘁𝘁𝗹𝗶𝗻𝗴
↳ Throttling and rate limiting are vital for reducing API abuse and protecting against DDoS attacks as they manage request rates, which keeps our API available for legitimate users.
𝗜𝗻𝗽𝘂𝘁 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻
↳ Validating API inputs is crucial to safeguard against vulnerabilities like SQL injection and XSS. Whitelisting can also be useful here to ensure only valid data is processed.
𝗛𝗧𝗧𝗣𝗦
↳ Enforcing HTTPS for all API connections is a critical step in securing sensitive data since it ensures data encryption in transit, preventing attacks and interceptions.
𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻
↳ Authentication is another must-have. Leverage strong authentication mechanisms, such as OAuth, to verify user or system identities.
𝗔𝘂𝘁𝗵𝗼𝗿𝗶𝘇𝗮𝘁𝗶𝗼𝗻
↳ After authentication comes authorization. Follow the least privilege principle to ensure users access only role-relevant data and actions, reducing unauthorized access risks.
𝗗𝗮𝘁𝗮 𝗲𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻 𝗮𝘁 𝗿𝗲𝘀𝘁
↳ Encrypting sensitive data at rest is crucial to prevent unauthorized access and comply with data protection regulations.
𝗔𝗣𝗜 𝗴𝗮𝘁𝗲𝘄𝗮𝘆
↳ Deploy an API Gateway as a security layer, managing authentication, monitoring traffic, and enforcing policies like rate limits.
𝗥𝗲𝗴𝘂𝗹𝗮𝗿 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝘂𝗱𝗶𝘁𝘀
↳ Regular security audits and penetration testing are advisable to identify and fix vulnerabilities, preventing exploitation and maintaining API security.
𝗗𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝗰𝘆 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁
↳ Regularly updating software dependencies is important to mitigate risks from vulnerabilities in external libraries.
𝗟𝗼𝗴𝗴𝗶𝗻𝗴 𝗮𝗻𝗱 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴
↳ Investing in comprehensive logging and real-time monitoring is vital for early detection of suspicious activities, enabling swift incident response to mitigate security breaches.
𝗔𝗣𝗜 𝘃𝗲𝗿𝘀𝗶𝗼𝗻𝗶𝗻𝗴
↳ To manage changes and updates securely, utilize proper API versioning, which prevents compatibility and security issues.
API security isn’t a nice-to-have. It’s a must.
Following the techniques and best practices I’ve shared above will take you a long way, they are the foundations of building safe and secure APIs.
💭 What else would you add? 💬
--
Thanks to our partner Sonar who keeps our content free to the community.
Compiles ≠ Correct. LLMs boost speed. SonarQube ensures that speed is safe.
Check it out: lucode.co/sonarqube-z1xbf
AI, But Make It Responsible! Happening today @AllThingsOpen at 2:45 PM in Ballroom C. We'll be talking about bias in AI and ways to create inclusive and trustworthy tools 🙂
🤯 89% of devs use #AI daily. Only 24% build APIs agents can use.
AI now reads your APIs more than humans do. If your docs aren’t built for machines, your APIs won’t keep up.
See how leading teams are closing the gap 👇
postman.com/state-of-api/202…
Ready to make this week amazing?
Join the @getpostman Discord Server!
✅ Connect with other Postman users
✅ Engage in our weekly challenges
✅ Get expert help & support
✅ Share learn about APIs
discord.gg/45zMGKDpg2#postman#APIs#community
The new @HubSpotDev platform is here, and it’s a game-changer.
Serverless functions are moving to external hosting hubspot.fetch() in v2025.2.
I break down how to migrate private apps & future-proof your apps 👉developers.hubspot.com/blog/…#HubSpot#Serverless#AWS