Hubspot trigger refers to non-existent scope

realflash · July 15, 2025, 4:41am

Describe the problem/error/question

In attempting to build the workflow, executing the Hubspot Trigger node results in the error below.

There seems to be no HubSpot scope called “errors”. Is this an API response that has not been properly interpolated? I can imagine there could be an errors variable in the response to that API call.
There seems to be no logs indicating the API call made or its response in either the console output or the event log. I’ve increased the log level to debug. Should it be somewhere else?

What is the error message (if any)?

" Problem running workflow Bad request - please check your parameters HubSpot Trigger: To subscribe to these events your app must require certain scopes defined in “errors”. Update your app’s auth configuration to fix this."

2025-07-15T04:43:10.768Z | error | Bad request - please check your parameters {"file":"error-reporter.js","function":"defaultReport"}

Please share your workflow

Information on your n8n setup

n8n version: 1.102.3
Database (default: SQLite): default
n8n EXECUTIONS_PROCESS setting (default: own, main): default
Running n8n via (Docker, npm, n8n cloud, desktop app): docker
Operating system: official docker image

zynate · July 15, 2025, 3:42pm

Add the missing scopes to your HubSpot app
Go to your HubSpot Developer Account → your app → Auth → Scopes.
Under Webhooks add “webhooks‐read” and “webhooks‐write”.
For each event type you subscribe to (e.g. contact.create, deal.propertyChange, etc.) make sure you’ve added the corresponding CRM scopes (contacts, deals, tickets, etc.).
Re-authorize your n8n HubSpot credential
In n8n go to Credentials → HubSpot OAuth2 → Reconnect / Reauthorize.
This pulls in the updated scopes.
Redeploy the HubSpot Trigger node
Open the workflow, click Reload on the HubSpot Trigger node.
It will now successfully subscribe to your events without the “errors” scope complaint.

realflash · July 15, 2025, 4:05pm

Thanks, but that’s not really the question. How do I found out which scopes are causing the problem other than guessing/inferring? I feel like there is a layer of debugging missing and I’m trying to work out whether to request an improvement or whether as a new user this information is available somewhere I don’t know about yet. How do I see the HubSpot API response and the call that was made?

zynate · July 15, 2025, 4:14pm

Enable Debug-Level HTTP Logging

In your n8n container’s environment, add:

N8N_LOG_LEVEL=debug

Restart n8n.
Now, every outgoing HTTP request (including to HubSpot) and its full response will be logged to your console. Look for lines like:

[HTTP Request] POST https://api.hubapi.com/webhooks/v1/…
[HTTP Response] 403 { "status": "error", "message": "…missing scope errors…" }
```This will show you the exact JSON payload and error fields that HubSpot returned.
2. **Inspect the Node Execution in the UI**
  * Go to **Executions** in the left sidebar.
  * Find the run where your HubSpot Trigger node errored, and click it.
  * Click on the **HubSpot Trigger** node in the diagram.
  * In the right-hand “Node” panel, expand the **“HTTP details”** section (or “Show full response” toggle).
  * You’ll see the **Request URL**, **Headers**, **Body**, and the **Response status** + **Body**.
3. **Use a Proxy or RequestBin (Optional)**
  * If you want an external view, set your container to route HubSpot traffic via a simple proxy (e.g. [RequestBin](https://requestbin.com)) by changing the base URL in the credential temporarily.
  * Then trigger the node and inspect exactly what HubSpot sent back.

Once you can see HubSpot’s raw error JSON (it’ll usually list the exact scopes it wanted), you can add only those to your app’s auth settings instead of guessing “errors.”

realflash · July 17, 2025, 7:01am

Thanks. I had already done that. It doesn’t show the request or reply in the log:

2025-07-17T06:58:53.750Z | error | Bad request - please check your parameters {"file":"error-reporter.js","function":"defaultReport"}

Thus my wondering if there is another level of logging, or is it a bug because it should be logging it and isn’t, or is it an FR because these things are never logged.

matiquiel · July 17, 2025, 8:38pm

I’m having the same issue.
Hubspot only offers (ticket wise) a “tickets” scope in the app settings.

I believe N8N is trying to use scopes that are not available anymore

,“message”:“subscriptionType 'ticket.creation requires one of scopeCandidates on configured app: [RequiredScopeGroup{id=17, name=tickets, shortDescription=Read and write tickets, version=GRANULAR, visibility=VISIBLE},RequiredScopeGroup{id=689, name=tickets.sensitive.v2, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE},RequiredScopeGroup{id=274, name=crm.objects.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE},RequiredScopeGroup{id=276, name=crm.schemas.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE},RequiredScopeGroup{id=230, name=tickets.highly_sensitive, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE},RequiredScopeGroup{id=730, name=tickets.highly_sensitive.v2, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE},RequiredScopeGroup{id=189, name=tickets.sensitive, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}]”,“context”:{“subscriptionType”:[“ticket.creation”],“scopeCandidates”:[“[RequiredScopeGroup{id=17, name=tickets, shortDescription=Read and write tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=689, name=tickets.sensitive.v2, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=274, name=crm.objects.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=276, name=crm.schemas.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=230, name=tickets.highly_sensitive, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=730, name=tickets.highly_sensitive.v2, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=189, name=tickets.sensitive, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}]”]}}],“category”:“VALIDATION_ERROR”,“subCategory”:“SubscriptionErrors.REQUIRED_SCOPES_SUBSCRIPTION_FAIL”}"

realflash · July 19, 2025, 6:37am

By prodding the API manually I have generated this error:

{
    "status": "error",
    "message": "To subscribe to these events your app must require certain scopes defined in \"errors\". Update your app’s auth configuration to fix this.",
    "correlationId": "aa4b5735-abb5-4ff3-8aa4-2cd24a43f7f1",
    "errors": [
        {
            "subCategory": "SubscriptionErrors.REQUIRED_SCOPE_SUBSCRIPTION_DETAIL",
            "message": "subscriptionType 'ticket.creation requires one of scopeCandidates on configured app: `[RequiredScopeGroup{id=17, name=tickets, shortDescription=Read and write tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=689, name=tickets.sensitive.v2, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=274, name=crm.objects.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=276, name=crm.schemas.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=230, name=tickets.highly_sensitive, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=730, name=tickets.highly_sensitive.v2, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=189, name=tickets.sensitive, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}]`",
            "context": {
                "subscriptionType": [
                    "ticket.creation"
                ],
                "scopeCandidates": [
                    "[RequiredScopeGroup{id=17, name=tickets, shortDescription=Read and write tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=689, name=tickets.sensitive.v2, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=274, name=crm.objects.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=276, name=crm.schemas.tickets.read, shortDescription=Tickets, version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=230, name=tickets.highly_sensitive, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=730, name=tickets.highly_sensitive.v2, shortDescription=Tickets (highly-sensitive), version=GRANULAR, visibility=VISIBLE}, RequiredScopeGroup{id=189, name=tickets.sensitive, shortDescription=Tickets (sensitive), version=GRANULAR, visibility=VISIBLE}]"
                ]
            }
        }
    ],
    "category": "VALIDATION_ERROR",
    "subCategory": "SubscriptionErrors.REQUIRED_SCOPES_SUBSCRIPTION_FAIL"
}

So it seems fairly obvious that this is a bug, in that the trigger has been written in a way that expects me to be able to view the contents of errors, but that content is never printed in the log so the user has no way of getting to it.

There seems to be a related issue; when you connect to HubSpot to create credentials, n8n selects a requested set of scopes (contacts, companies, deals). If these don’t match what’s been configured in the HubSpot Developer app, the credentials cannot be created. If you change the required scopes in the app to match what has been requested, then you only get the data for those things. So there will never be a way to get events for tickets, for example.

There needs to be a way to select the required and optional scopes that are being requested when the credential is being created, so that they match the app you are connecting to.

I will raise these things in the appropriate way.

system · October 17, 2025, 6:37am

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.