@revfleet/hscli 0.8.12 → 0.9.1

package/docs/INTERNAL-ENDPOINTS-DISCOVERY.md

@@ -0,0 +1,813 @@
+# HubSpot Internal Endpoints — Discovery Log
+
+Live capture of internal API surfaces for gap areas where hscli adapters are missing or incomplete. READ-ONLY on live portal <portalId>. No POST/PUT/PATCH/DELETE.
+
+Each iteration appends a new ## YYYY-MM-DD — {area} section. Confirmed endpoints get merged into INTERNAL-ENDPOINTS.md.
+
+2026-06-19 — Iteration 1: Reports / Dashboards / Datasets
+Captured by opening live report <id> then "Edit in report builder".
+
+Reports surface (new)
+Method	Path	Note
+GET	/api/dashboard/v2/favorite/all	All starred reports/dashboards.
+GET	/api/dashboard/v2/reports/{id}/record-view	Telemetry: increments "Total views".
+GET	/api/dashboard/v2/reports/<id>	Full report definition incl. displayParams, aggregations, dimensions, filters. Source of truth for fidelity-preserving export/import.
+GET	/api/external-options/v3/pagedFetch/OWNER	Owner typeahead for filter widgets.
+GET	/api/external-options/v3/fetch/{ENTITY}	Generic entity option fetch.
+GET	/api/multi-currency/v2/currencies/information	Currency list (needed for revenue reports).
+GET	/api/associations/v1/definitions/{typeId}	Association definitions for the report's primary type.
+GET	/api/inbounddb-meta/v1/object-types/{typeId}	Object-type metadata.
+GET	/api/properties/v4/groups/{typeId} + /properties	Property catalogue + groups for the report's object.
+Datasets / resolve (the actual data fetch)
+Method	Path	Note
+POST	/api/reporting/v3/dataset/resolve/async	Submits a dataset query. Body = report definition payload. Returns requestId.
+GET	/api/reporting/v3/dataset/resolve/async/{requestId}	Poll for the result. Returns resolved aggregations + rows.
+GET	/api/reporting/v3/journey/{reportId}/resolve/async	Variant for journey reports.
+GET	/api/reporting-usage-service/v1/ingestion/report	Resolve telemetry.
+Report templates / discovery
+Method	Path	Note
+GET	/api/reporting-discovery/v1/report-template	List built-in templates.
+GET	/api/reporting-discovery/v1/report-template/paged	Paged.
+GET	/api/reporting-discovery/v1/report-template/template-key/{slug}	Single template definition (e.g. sales.team).
+GET	/api/reporting-frontend/v1/reports/get-portal-reports	Portal-wide report list (alt to dashboard/v2/reports).
+POST	/api/reporting-migration/v2/reports/migrate	Internal cross-portal report migration endpoint! (Surfaced when opening a report — confirms HubSpot has its own migration tooling under the hood.)
+AI copilot (insights generation)
+Method	Path	Note
+GET	/api/reporting-insights/copilot/v1/abtest/options	Copilot AB test config.
+POST	/api/reporting-insights/copilot/v2/generate	Generate insights. Returns request ID.
+GET	/api/reporting-insights/copilot/v2/generate/status/{id}	Poll for insights result.
+Framework / schema metadata
+Method	Path	Note
+GET	/api/framework-builder/v1/read/metadata/types/crmSegmentsUI	CRM Segments UI type metadata.
+GET	/api/framework-builder/v1/read/metadata/types/crm	All CRM types.
+GET	/api/framework-builder/v1/read/metadata/property/{typeId}/{aspect}	Aspect ∈ crm, property, gibberishdetectionmetadata.
+GET	/api/inbounddb-meta/v1/object-types/{typeId}	Object type metadata.
+Chirp RPCs observed
+com.hubspot.reporting.api.metadata.rpc.ReportingApiMetadataRpc/getPropertyMetadata (slow gateway)
+com.hubspot.reporting.api.metadata.rpc.ReportingApiMetadataRpc/getPropertyMetadataGroups (slow gateway)
+com.hubspot.blueprint.customer.object.type.rpc.CustomerObjectTypeRpc/getAllEnabledAndDisabledObjectTypeDefinitionsForPortalSorted
+Telemetry / infra (skip for migration purposes)
+metrics-fe-na1.hubspot.com/metrics/v1/frontend/send, metrics-fe-na1.hubspot.com/metrics/v1/frontend/custom/send, exceptions.hubspot.com/frontend/observability/page-tracking/store/, exceptions.hubspot.com/v2/api/js/store/, /api/cartographer/v1/rhumb, /api/cartographer/v1/performance, /api/usage-logging/v1/log/hublytics-multi/no-auth, /api/usage-logging/v1/log/session-replay
+
+Fidelity assessment for migration
+Reports: GET /api/dashboard/v2/reports/{id} returns enough to recreate (filters, dimensions, aggregations, viz). For adapter: serialize this JSON, remap property names + object IDs in destination portal, POST back.
+Datasets: /api/reporting/v3/dataset/resolve/async is read-only data fetch — not part of the asset definition. Don't migrate; it's computed.
+Journey reports: separate endpoint family. Need to test fidelity separately.
+Report templates: template-key references stay valid across portals (built-in catalogue). Custom-template-based reports need template body migration first.
+Adapter gap: HubSpot has POST /api/reporting-migration/v2/reports/migrate — worth a separate investigation iteration to see if this can be reused for cross-portal report copy.
+
+2026-06-19 — Iteration 2: Workflows v4 full fidelity (automationplatform/v1)
+Captured by opening live workflow <id> (USA | <asset prefix> | Lead Status to Lead Pipeline) in the editor.
+
+🔑 CSRF unlock pattern (works for ALL these endpoints)
+Previously got 401 on internal endpoints. Solution: read cookie hubspotapi-csrf and send as header X-HubSpot-CSRF-hubspotapi.
+
+const csrf = document.cookie.split('; ').find(c => c.startsWith('hubspotapi-csrf='))?.split('=')[1];
+const r = await fetch(url, { credentials: 'include', headers: { 'X-HubSpot-CSRF-hubspotapi': csrf } });
+This is the key that unlocks every internal endpoint that was previously 401. Apply throughout the adapter layer.
+
+Workflows surface (the real source of truth — NOT v3/v4 public)
+Method	Path	Status	Note
+GET	/api/automationplatform/v1/hybrid/{flowId}	✅ 200	THE full workflow definition. Returns: flowType, isEnabled, name, firstActionId, timeWindow, enrollmentSchedule, shouldReenroll, flowObjectType, objectTypeId, enrolledType, enrollmentDataset, triggers, triggerTypeId, portalId, flowId, creator*, actions[], branches, goals, etc. Source of truth for fidelity-preserving migration.
+GET	/api/automationplatform/v1/validation/{flowId}	✅ 200	valid: bool, errors[], warnings[].
+GET	/api/automationplatform/v1/output-fields/flow/{flowId}/allOutputs	✅ 200	enrolledObjectOutputs, actionTypeOutputs, instanceOutputs — outputs available for downstream action references.
+GET	/api/automationplatform/v1/access/object-enrolled-type-access	✅	Which object types user can enroll.
+GET	/api/automationplatform/v1/access/permission-check/flow/{flowId}	✅	Per-flow access check.
+POST	/api/automationplatform/v1/access/permission-check/flow/batch/read	✅	Batch access check.
+POST	/api/automationplatform/v1/filter-descriptions/generate	✅	Human-readable filter description.
+GET	/api/automation/v4/actions/internal/access/definitions/filter	✅	Action catalogue — all available action types + their config schemas. Critical for building the adapter since actions[] in the hybrid response references these definitions.
+POST	/api/automationmanagement/v1/revision/revert	⚠️ WRITE	Revision rollback. DO NOT call in read-only mode.
+Workflow apps / CRM integration
+Method	Path	Status	Note
+GET	/api/automationapps/v1/flow-crm-objects/{flowId}	✅ 200	Returns enrolled CRM object snapshot incl. properties, associations, state, archival history. ~28KB per flow.
+GET	/api/automationapps/v1/insights/canvas/errors/{flowId}	✅ 200	executionErrors, enrollmentErrors.
+GET	/api/automation-platform-bulk-processing/v1/bulk-processing/flow/{flowId}	✅ 200	Bulk processing jobs (currently []).
+Workflow chirp RPCs
+POST /api/chirp-frontend-app/v1/gateway/com.hubspot.workflow.canvas.rpc.FlowCardPositionRpc/getCardPositions — canvas layout coordinates per card. POST /api/chirp-frontend-app/v1/gateway/com.hubspot.automation.access.rpc.AutomationAccessRpc/getFeatureAccess (slow gateway). POST /api/chirp-frontend-app/v1/gateway/com.hubspot.automationplatform.chirp.rpc.DelayedActionsService/getDelayActionEnrollmentCounts. POST /api/chirp-frontend-app/v1/gateway/com.hubspot.automation.actions.rpc.RenderableActionDefinitionService/search — search action types by query (used by editor's "+ add action" UI). POST /api/chirp-frontend-app/v1/gateway/com.hubspot.automationplatform.chirp.rpc.FlowBillingRpc/getFlowBillingInfo — flow billing/usage. POST /api/chirp-frontend-app/v1/gateway/com.hubspot.workflows.copilot.rpc.WorkflowsCopilot/fetchInteractiveModeContextForFlow — Copilot context.
+
+Supporting endpoints (CRM/object plumbing for workflow editor)
+Path	Note
+/api/inbounddb-meta/v1/object-types/for-portal	All object types for portal.
+/api/inbounddb-meta/v1/object-types/{typeId}	Single.
+/api/properties/v4/groups/{typeId} + /properties	Property catalogue.
+/api/associations/v1/definitions/{typeId}	Assoc definitions.
+/api/owners/v2/owners/batch-v2	Batch owner read.
+/api/integrators/timeline/internal/v4/event-type-installations/by-user	Timeline event types per user.
+/api/framework-builder/v1/read/metadata/type/all/batch	Batch type metadata.
+/api/multi-currency/v2/currencies/information	Currencies.
+/api/crm-search/search	Generic CRM search (used by triggers/filters).
+Workflow chirp RPCs (more)
+com.hubspot.unified.events.rpc.UnifiedEventsEventTypeRpc/getAllEventTypeCategories
+com.hubspot.ubb.component.status.service.rpc.UbbComponentStatusServiceAppRpc/getComponentStatusForPortal
+com.hubspot.usagebasedbilling.experience.rpc.UsageBasedBillingExperienceRpc/getUsagePeriodUsage
+Fidelity adapter design implications
+Full workflow definition is reachable via GET /api/automationplatform/v1/hybrid/{flowId} with CSRF — includes the full actions[] array (previously thought internal-only via v4 public API).
+Action type catalogue is at GET /api/automation/v4/actions/internal/access/definitions/filter — needed to validate and remap action types between portals.
+Output references (/output-fields/.../allOutputs) tell you which prior actions an action depends on — critical for remapping action IDs in destination portal.
+Adapter strategy:
+GET hybrid → serialize
+Remap objectTypeId, owner IDs, property internal names, list IDs, action references between portals
+Force isEnabled: false, shouldReenroll: false on import
+POST to destination's hybrid endpoint (POST verb not yet confirmed — needs separate exploration in a sandbox portal, NOT live)
+2026-06-19 — Iteration 3: Service Hub (chatflows, help desk, SLA, inbox)
+Captured by opening /chatflows/<portalId> and /help-desk/<portalId>.
+
+Chatflows (entirely behind chirp)
+Method	Path	Note
+POST	/api/chirp-frontend-app/v1/gateway/com.hubspot.chatflows.rpc.ChannelInstanceRpc/getUserChatflowsSortedByPriority	List chatflows + priority order.
+POST	/api/chirp-frontend-app/v1/gateway/com.hubspot.chatflows.rpc.ChatflowsRpc/getSearchMeta	Search metadata.
+No public CRUD REST API found in this iteration. Service surface is RPC-only. Chatflows list shows web/mobile/Facebook channels. Confirmed ~30 chatflows in portal across DE/FR/NL/EN/ES geos.
+
+Help Desk (workspace + custom views)
+Method	Path	Note
+GET	/api/conversations-custom-views/v1/settings/users	Workspace user settings.
+GET	/api/conversations-custom-views/v1/spaces-and-views/workspace/{workspaceId}	Spaces + views in a workspace (workspaceId from URL).
+GET	/api/conversations-custom-views/v1/settings/views/{viewId}	Single view definition.
+GET	/api/conversations-email/v1/connected-accounts/inbox/{inboxId}	Connected email accounts per inbox.
+GET	/api/conversations-channels/v1/channel-instances/inbox/{inboxId}/paged	Channel instances (chat/email/etc) per inbox.
+GET	/api/cv/inbox/settings/v1/user-prompts	UI prompts.
+GET	/api/email-mta-sending/v1/auth-domains/active-domains-with-state	Active sending domains.
+GET	/api/customer-object-types/v1/for-portal	Custom object types.
+GET	/api/properties/v4/groups/0-5/properties	Ticket properties (object type 0-5).
+GET	/api/associations/v1/definitions/0-5	Ticket associations.
+POST	/api/graphql/crm	GraphQL endpoint for CRM queries.
+POST	/api/crm-search/search	Tickets search.
+Help Desk chirp services
+com.hubspot.cv.custom.views.member.rpc.CvCustomViewsMemberRpc/getPagedHelpDeskTickets — list tickets per view
+com.hubspot.cv.tickets.notification.preferences.rpc.TicketNotificationPreferenceFrontendRpc/getUserNotificationPreferences
+com.hubspot.cv.search.rpc.HelpdeskSearchHistoryRpc/getSearchHistory
+com.hubspot.cv.assignments.rpc.UserCapacityLimitsV2Service/getCurrentUserCapacityData — assignment capacity
+com.hubspot.helpdesk.migration.rpc.HelpdeskMigrationRpc/getMigrationStatusesForPortal — HubSpot's own help desk migration RPC
+com.hubspot.blueprint.object.library.rpc.ObjectLibraryRpc/getEnablementStatusForObjectTypes
+com.hubspot.upgrade.management.rpc.UpgradeConfigInAppRpc/getUpgradeConfigWithPurchaseMotions
+Onboarding tasks (used in Service Hub UI)
+GET /api/usercontext/v1/onboarding/tasks/{guideKey} — e.g. hd_in_workspace_onboarding_guide
+GET /api/usercontext/v1/onboarding/progress/{guideKey}
+Not found in this portal
+/settings/<portalId>/inbox/sla → 404 (no SLA configured on this portal — Service Hub not provisioned)
+/settings/<portalId>/inbox/ → 404
+/help-desk/<portalId>/settings/sla → redirects to help-desk list
+Adapter gap remains: SLA policies, customer portal, and KB articles need a separate portal where these are enabled. Conversations-custom-views + conversations-channels endpoints are the discovery surface for inbox routing config.
+
+2026-06-19 — Iteration 4: Permission set assignment (admin/access)
+All confirmed working with CSRF (X-HubSpot-CSRF-hubspotapi header).
+
+Permission sets
+Method	Path	Status	Response	Note
+GET	/api/app-users/v1/permission-sets?portalId={p}	✅ 200	Array[72]	All permission sets on portal incl. names, capability flags, scopes. ~160KB.
+GET	/api/app-users/v1/permission-sets/{psId}	✅	object	Single permission set + full capability matrix.
+GET	/api/app-users/v1/permission-sets/permission-set-user-assignments	✅ 200	{hubId, userPermissionSetIds}	THE assignment endpoint — returns map of userId → permissionSetIds[]. 56KB for 2,977 users.
+GET	/api/app-users/v1/roles?portalId={p}	✅ 200	Array[1124]	Roles (more granular than permission sets — 1124 in this portal).
+GET	/api/permission/templates/v1/permission-templates/hub/{portal}	✅ 200	Array[12]	Permission templates (Super Admin, Marketing, Sales, etc.).
+Seats
+Method	Path	Status	Response
+GET	/api/app-users/v1/seat-assignments/{portal}	✅ 200	Array[2977] — user→seat assignments
+GET	/api/app-users/v1/seat-assignments/{portal}/seat-info	✅ 200	Array[4] — seat types + counts + limits
+GET	/api/app-users/v1/seat-purchase/pending-downgrades	✅	Pending seat downgrades
+GET	/api/app-users/v1/sales-products	✅	Sales products (seat-related)
+GET	/api/app-users/v1/sales-products/product-info	✅	Product info
+Users / teams
+Method	Path	Status	Note
+GET	/api/app-users/v1/users/{userId}	✅	Single user incl. permission set + role assignment.
+POST	/api/app-users/v1/users/partial/batch	✅	Batch read users.
+GET	/api/app-users/v1/teams	✅	Teams.
+GET	/api/teams/v1/team-hub-settings?portalId={p}	✅ 200	{defaultContentAssignmentOn, hubId}
+Other access plumbing
+Path	Note
+/api/external-options/v3/fetch/PERMISSION_SET	Typeahead-friendly permission set fetch.
+/api/external-options/v3/fetch/TEAM	Same for teams.
+/api/vetting/public/v1/user-verification/bannerinfo/scope/users-write	Identity verification gate (banner shown before writes).
+/api/user-email-updates/v1/domain-change/current	Current domain-change request (admin context).
+/api/bizops-services-customers/v3/hub-contact-roles/external	External hub contact roles.
+Chirp RPCs (users service)
+com.hubspot.appusers.rpc.UsersRpc/getUsersByIds
+com.hubspot.appusers.rpc.UsersRpc/getUserIdsOnHubByRoleIdAndPendingStatus
+com.hubspot.appusers.rpc.UsersRpc/filterOutInvisibleUsers
+Adapter design — permission set migration
+The full loop is now reachable read-only:
+
+Source: GET /api/app-users/v1/permission-sets → all 72 PS definitions
+Source: GET /api/app-users/v1/permission-sets/permission-set-user-assignments → user→PS map
+Map between portals by name (HubSpot uses name+capability fingerprint, not ID) OR by capability shape
+Destination write (NOT in scope here — read-only mode):
+POST /api/app-users/v1/permission-sets to create
+POST /api/chirp-frontend-app/v1/gateway/com.hubspot.appusers.rpc.PermissionSetAssignmentsRpc/assignUserToPermissionSets?portalId={portalId} to assign one or more permission sets to one or more users.
+Confirmed body: `{ "assignments": [{ "userId": "<id>", "permissionSetIds": ["<permissionSetId>"] }] }`.
+
+2026-06-19 — Iteration 5: Field-level permissions replay
+Captured by opening /property-settings/<portalId>/properties?type=0-1 and probing endpoints with CSRF.
+
+Blocklist (global + per-object)
+GET /api/crm-permissions/v1/field-level-permissions/blocklist/including-global?portalId={p} → ✅ 200
+
+{
+  "blocklistedPropertiesByObjectTypeId": {
+    "0-1": ["email","firstname","hs_pipeline","lastname","lifecyclestage", ...],
+    "0-2": ["domain","hs_is_target_account","hs_pipeline","lifecyclestage","name"],
+    "0-3": ["closedate","deal_currency_code","dealname","dealstage","notes_last_updated","pipeline"],
+    "0-5": [...],
+    "0-101": ["hs_currency_code"],
+    "0-69": ["hs_currency_code"],
+    "2-<id>": [...]   // custom objects
+  },
+  "globallyBlocklistedProperties": ["hs_object_id", "this_is_a_test_globally_blocklisted_property"]
+}
+Full blocklist state is reachable read-only. This is what FLP "cannot restrict access to this property" boils down to.
+
+Allowlist access-state (per object + property)
+POST /api/crm-permissions/v1/field-level-permissions/allowlistings/access-state/multi-get?portalId={p} → ✅ 200
+
+Request body shape (figured out by probing):
+
+{ "objectTypeIds": ["0-1", "0-2"] }
+Optional refinement: { "objectTypeIds": ["0-1"], "propertyNames": ["usa___asen___sales_owner"] }.
+
+Response:
+
+{
+  "0-1": {
+    "br___mail_tecnico": "LIMITED_TO_SUPER_ADMINS",
+    "eu___example_brand___c_sat___customer_care": "LIMITED_TO_SUPER_ADMINS",
+    "subscribe_to_example_blog_checkbox_version": "LIMITED_TO_SUPER_ADMINS",
+    ...
+  }
+}
+Access states observed: LIMITED_TO_SUPER_ADMINS. Other expected values per HubSpot UI: READ_ONLY_FOR_NON_SUPER_ADMINS, HIDDEN_FROM_NON_SUPER_ADMINS, EDITABLE (default — not returned).
+
+Other FLP endpoints
+Method	Path	Status	Note
+GET	/api/crm-permissions/v1/field-level-permissions/allowlistings/{typeId}	❌ 404	No bulk fetch by object — use multi-get.
+GET	/api/crm-permissions/v1/field-level-permissions/allowlistings/{typeId}/{property}	❌ 404 if no allowlist exists	Returns 404 when property has default access.
+GET	/api/permissions-skynet/v1/scopes/app/field-level-permissions-bypass/user-ids	✅	Users who bypass FLP.
+Adapter design — FLP replay
+Read source:
+
+GET blocklist/including-global → full blocklist (mostly read-only HubSpot defaults; rarely custom).
+POST allowlistings/access-state/multi-get with {objectTypeIds: [all custom + standard]} → full allowlist state map.
+Write to destination (NOT in scope here — sandbox required): 3. PUT /api/crm-permissions/v1/field-level-permissions/allowlistings/{typeId}/{property} (assumed) with body like { accessState: "LIMITED_TO_SUPER_ADMINS" }.
+
+Gap: write endpoint not yet confirmed — needs sandbox.
+
+Other endpoints surfaced from property settings page
+Path	Note
+/api/framework-builder/v1/read/metadata/types/crmPropertySettingsUI	UI metadata.
+/api/schemas-metadata/v1/portal-metadata/type/PROPERTY/paged	Paged property metadata.
+/api/property-settings/v1/property-fill-rate/{typeId}/batch/read	Fill rates per property.
+Chirp RPCs (custom enrichment / smart properties)
+com.hubspot.custom.enrichment.rpc.client.PropertyConfigService/getProperties
+com.hubspot.custom.enrichment.rpc.client.PropertyConfigService/getSmartPropertyMetrics
+com.hubspot.custom.enrichment.rpc.client.SmartPropertyWorkflowService/getWorkflowsByPropertyConfigIds
+2026-06-19 — Iteration 6: Subscription types (Email/Chat/Call/Post)
+Captured by opening /settings/<portalId>/marketing/email/types and probing endpoints.
+
+Full subscription type list
+GET /api/email/public/v1/subscriptions?portalId={p} → ✅ 200, 66KB
+
+Despite the /email/ prefix, returns ALL subscription types across every channel — Email, Chat, Call, Post, and unspecified.
+
+In live portal <portalId>:
+
+Channel	Count
+Email	146
+Chat	19
+Call	3
+Post	3
+(empty/legacy)	74
+Total	245
+Each subscription type object:
+
+{
+  "id": <id>,
+  "portalId": <portalId>,
+  "businessUnitId": <id>,
+  "name": "Active Pest Marketing Communications",
+  "internalName": "MARKETING_INFORMATION",
+  "description": "I want to receive marketing offers and updates.",
+  "category": "Marketing",   // or "Consent" (chat tracking) or empty
+  "channel": "Email",         // Email / Chat / Call / Post / empty
+  "active": true,
+  "internal": false
+}
+Visibility rules / subscription RPCs
+Method	Path	Note
+POST	/api/chirp-frontend-app/v1/gateway/com.hubspot.subscriptions.settings.rpc.service.RulesRpc/getAllRules	Visibility rules (which BU/language combos see which subs).
+POST	/api/chirp-frontend-app/v1/gateway/com.hubspot.subscriptions.settings.rpc.service.RulesRpc/getAllDefinitionRules	Rule definitions.
+POST	/api/chirp-frontend-app/v1/gateway/com.hubspot.data.privacy.hub.settings.rpc.PrivacySettingsRpc/getPrivacySettings	Privacy / GDPR config.
+POST	/api/chirp-frontend-app/v1/gateway/com.hubspot.business.units.rpc.BusinessUnitsDisplaysService/getBusinessUnitDisplaysForUser	BU display map (used by subscription editor).
+Supporting endpoints
+Method	Path	Note
+GET	/api/content/api/v4/can-spam-settings?portalId={p}	CAN-SPAM footer addresses list.
+POST	/api/subscriptions-settings/v1/settings/multi-get	Body: string[] of setting keys.
+GET	/api/navconfig/v2/navconfig/settings-preferences	Settings nav config.
+GET	/api/cosemail/v1/subscription-emails/{type}/get	Subscription email template (e.g. RESUBSCRIBE_EMAIL).
+Adapter design — subscription types
+Read source:
+
+GET /api/email/public/v1/subscriptions → all 245 subs across all channels.
+RulesRpc getAllRules → visibility rules (BU + language + sub mapping).
+Write to destination (NOT in scope here): 3. POST /api/email/public/v1/subscriptions (assumed) per subscription type. 4. Visibility rules likely via a separate RPC write — sandbox required.
+
+Gap closed: Non-email subscription types (Chat/Call/Post) DO have a public/internal endpoint after all. They were previously thought adapter-incomplete because marketing/v3/subscriptions/{}/... only deals with email contact subscriptions, not the type definitions themselves.
+
+2026-06-19 — Iteration 7: Brand kits
+Captured by opening /settings/<portalId>/account-defaults/branding (redirects to /brand-identity/<portalId>/brand/{buId}/brand-kit) and probing.
+
+Brand kits surface (CSRF required)
+Method	Path	Status	Response	Note
+GET	/api/branding/v1/brand-kit?portalId={p}	✅ 200	Array[21]	All brand kits on portal. ID, name, BU id, activeThemePath, primaryBrandKit flag.
+GET	/api/branding/v1/brand-kit/all?portalId={p}	⚠️ 400	error	Likely needs different query (e.g. ?buId=).
+GET	/api/branding/v1/brand-kit/{kitId}	✅	single	Single kit detail.
+GET	/api/branding/v1/colors/brand-kit?portalId={p}	✅ 200	Array[9]	All brand colors.
+GET	/api/branding/v1/logos/brand-kit?portalId={p}	✅ 200	Array[10]	All logos.
+GET	/api/branding/v1/favicons/brand-kit?portalId={p}	✅ 200	Array[24]	All favicons.
+GET	/api/branding/v1/fonts-with-variants?portalId={p}	✅ 200	Array[]	Custom fonts (empty in this portal).
+GET	/api/branding/v1/font-meta?portalId={p}	❌ 403	Not enabled on this portal.	
+GET	/api/branding/v1/brand-voice/by-bu-id/{buId}	✅	Brand voice (used by AI copy generation).	
+GET	/api/branding/v1/brand-kit/business-unit/{buId}	✅	Kit per BU.	
+Brand kit object shape
+{
+  "id": <id>,
+  "portalId": <portalId>,
+  "buId": 0,
+  "businessUnitId": null,
+  "name": "<brand name>",
+  "activeThemePath": "<client>_November2022",
+  "activeThemePresetId": null,
+  "activeThemePresetPath": null,
+  "activeThemePresetType": null,
+  "primaryBrandKit": true,
+  "createdAt": <id>,
+  "createdBy": 100,
+  "modifiedAt": <id>,
+  "deletedAt": null
+}
+Business units (needed for brand kit context)
+Method	Path	Status	Response
+GET	/api/business-units/v1/business-units?portalId={p}	✅ 200	Array[21]
+Adapter design — brand kits
+Read source (all CSRF):
+
+GET /api/business-units/v1/business-units → BU list
+GET /api/branding/v1/brand-kit → all brand kits
+GET /api/branding/v1/colors/brand-kit, /logos/brand-kit, /favicons/brand-kit → assets
+Per kit: 4. GET /api/branding/v1/brand-kit/business-unit/{buId} → detailed BU-scoped kit 5. GET /api/branding/v1/brand-voice/by-bu-id/{buId} → brand voice
+
+Write to destination (NOT in scope — needs sandbox): 6. Create BUs first; remap buId → new BU IDs 7. POST brand kit → POST colors/logos/favicons referencing new kit ID
+
+Gap closed: brand kits ARE accessible via REST (not just chirp). Logos/favicons are URLs to HubSpot file storage — adapter needs to download from source CDN and re-upload via Files API.
+
+2026-06-19 — Iteration 8: Marketing email (cosemail surface — corrects prior 404 finding)
+Earlier sessions concluded marketing email APIs were all 404 from in-tab. That was WRONG. The correct internal surface is /api/cosemail/v1/... — confirmed working with CSRF in this iteration.
+
+Marketing emails (cosemail)
+Method	Path	Status	Response	Note
+GET	/api/cosemail/v1/emails?portalId={p}&limit={n}&businessUnitId={buId}	✅ 200	{objects[], total, totalCount, limit, offset}	18,722 emails in this portal. Total ~198KB for limit=5.
+GET	/api/cosemail/v1/emails/{id}	✅ 200	15KB	Full email definition — see shape below.
+GET	/api/cosemail/v1/subscription-emails/{type}/get	✅	Type-specific email template (e.g. RESUBSCRIBE_EMAIL).	
+Email object shape (~196 keys per email)
+Includes everything needed for fidelity-preserving migration:
+
+Identity: id, name, subject, previewText, slug, language, businessUnitId, campaign, campaignName, campaignUtm, category, categoryId, folderId, folderIdV2
+
+Sender: fromName, replyTo, customReplyTo, customReplyToUserId
+
+Design fidelity (the gap):
+
+dragAndDropLayoutId — D&D layout reference
+dragAndDropThemeId — theme reference
+flexAreas — flexible content areas
+headerFooterModules — header/footer module config
+attachedStylesheets
+css, cssText
+emailBody, emailbodyPlaintext
+editorVersion, emailTemplateMode, emailType (DRAG_AND_DROP_EMAIL etc.)
+featuredImage, featuredImageHeight, featuredImageLength, featuredImageWidth
+A/B: ab, abVariation, abTestPercentage, abTestType, abHoursToWait, abSamplingDefault, abSampleSizeDefault, abSuccessMetric
+
+Publishing: currentState, currentlyPublished, isDraft, isPublished, archived, archivedAt, archivedInDashboard, freezeDate, created, createdById, createdByAgent, audienceAccess
+
+Tracking: disableAllTracking, analyticsPageId, analyticsPageType, canSpamSettingsId, feedbackFormId, feedbackSurveyId, formId
+
+Lifecycle: crmObjectId, errors, errorDate, fixupHistory, clonedFrom, emailRenderSwimlane, emailNote, emailPublishTag, allEmailCampaignIds, hasUserChanges
+
+What's NOT in cosemail (tried, all 404)
+/api/cosemail/v1/email-themes
+/api/cosemail/v1/email-modules
+/api/cosemail/v1/saved-sections
+/api/cosemail/v1/global-modules
+/api/cosemail/v1/email-templates
+/api/email-saved-content-app/v1/saved-content
+/api/email-themes/v3/themes
+/api/design-manager/v3/themes
+/api/design-manager/v3/modules
+/api/saved-content/v1/saved-content
+Themes, modules, and saved sections are under a different surface. Need to navigate to Marketing > Files & Templates > Design Manager to find them. Defer to iteration #11 (CMS).
+
+Adapter design — marketing email
+Read source:
+
+GET /api/cosemail/v1/emails?limit=100&offset={n} — paginate through 18k+ emails.
+GET /api/cosemail/v1/emails/{id} per email — full definition (rarely needed; list already gives most fields).
+Resolve dragAndDropThemeId + dragAndDropLayoutId via design-manager (TBD).
+Resolve featuredImage URLs — re-host on dest via Files API.
+Write to dest (NOT in scope — sandbox required): POST /api/cosemail/v1/emails with the same shape.
+
+Gap closed (partial): email body + design payload reachable. Themes/modules still need iteration #11.
+
+2026-06-19 — Iteration 9: CTAs (legacy + new)
+Captured by opening /cta/<portalId>/.
+
+CTAs (placements = new + legacy)
+Method	Path	Status	Response
+GET	/api/ctas/v3/placements?portalId={p}&limit={n}&offset={n}	✅ 200	{results[], hasMore, offset, total} — 2,244 CTAs in this portal.
+GET	/api/ctas/v3/placements/{guid}?portalId={p}	⚠️	Direct ID lookup returned error (404-ish wrapper); the editor loaded individual placements via list+filter.
+CTA placement object shape
+{
+  "guid": "088d78df-da57-4a53-9b0e-7f4aae17dc25",
+  "portalId": <portalId>,
+  "name": "...",
+  "type": "...",
+  "createdAt": ..., "updatedAt": ...,
+  "createdBy": ..., "updatedBy": ...,
+  "deletedAt": null, "deletedBy": null,
+  "definitionId": "...",
+  "campaignId": "...",
+  "supportedEnv": "...",
+  "isMigrated": true|false,    // legacy→new CTA migration flag (HubSpot's own)
+  "visibleToAll": true|false
+}
+isMigrated is HubSpot's flag tracking the Legacy CTA → New CTA Builder migration. Source for our adapter to know which CTAs to migrate vs. which are already on the new builder.
+
+What's NOT a separate endpoint
+/api/ctas/v3/cta, /api/ctas/v1/ctas, /api/ctas/v2/ctas, /api/cta/v1/..., /api/cta-api/..., /api/ctas-legacy/... — all 404.
+Single endpoint /api/ctas/v3/placements/{guid} is the source for individual CTAs but UI uses the list endpoint for bulk read.
+Adapter design — CTAs
+Read source:
+
+GET /api/ctas/v3/placements?limit=200&offset={n} — paginate (hasMore + offset).
+Per CTA: full payload is in the list response (no per-CTA detail call needed for migration).
+Filter:
+
+isMigrated: true = on new CTA Builder (modern)
+isMigrated: false + deletedAt: null = still on legacy
+Write to dest (NOT in scope — sandbox required):
+
+POST /api/ctas/v3/placements per CTA.
+2026-06-19 — Iteration 10: Social + Ads
+Social
+Method	Path	Status	Response
+GET	/api/broadcast/v2/broadcasts?portalId={p}&limit={n}	✅ 200	Array[n] — 466KB for limit=100
+GET	/api/broadcast/v2/accounts/with-channels?portalId={p}	✅	Connected social accounts + channels (FB, IG, LinkedIn, TikTok, X, etc.).
+GET	/api/vetting/public/v1/user-verification/bannerinfo/scope/social-trusted	✅	Identity vetting banner.
+broadcast is HubSpot's term for "social post" — the system is named after the original "broadcast" composer.
+
+Ads (chirp-only)
+Method	Path	Note
+POST	/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.AdAccountRpc/getAdsAccountsOverviewForUser	Ad accounts + overview metrics.
+POST	/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.AdAccountRpc/getPortalMetaData	Portal-wide ads metadata.
+POST	/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.AuthRpc/getUserSummaries	Ad-related user summaries.
+POST	/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.UiSettingsRpc/getTableColumnInfo	UI column config.
+Ads is entirely RPC-driven. No REST endpoints found (/api/ads/v3/..., /api/ad-management/... all 404). Migration would need full chirp RPC client.
+
+Adapter design — Social + Ads
+Social:
+
+GET /api/broadcast/v2/accounts/with-channels → connected channels (FB pages, LinkedIn orgs, etc.)
+GET /api/broadcast/v2/broadcasts?limit=100&offset={n} → all broadcasts
+Ads: requires chirp client. Out of scope for REST-based adapter — would need a chirp gateway transport layer.
+
+2026-06-19 — Iteration 11: CMS (design manager, pages, domains, membership)
+Captured by opening /design-manager/<portalId>/.
+
+Design Manager (themes / templates / modules / layouts)
+Method	Path	Status	Response	Note
+GET	/api/designmanager/v1/themes?portalId={p}	✅ 200	4MB, ~120 themes	Full theme catalogue incl. HubSpot defaults + custom.
+GET	/api/designmanager/v1/templates?portalId={p}	✅ 200	50KB, 7000 templates	All HTML/HUBL templates.
+GET	/api/designmanager/v1/modules?portalId={p}	✅ 200	35KB, 2886 modules	All design-manager modules.
+GET	/api/designmanager/v1/layouts?portalId={p}	✅ 200	53KB, 776 layouts	Drag-and-drop layouts.
+GET	/api/designmanager/v1/layouts/global-groups/summaries	✅	Global header/footer/sidebar groups.	
+GET	/api/designmanager/v1/modules/builtin-mapping	✅	Built-in module mapping.	
+GET	/api/content/api/v2/templates?portalId={p}	✅ 200	2MB, 7000 templates	Alt path (content/api/v2).
+Pages
+Method	Path	Status	Response
+GET	/api/content/api/v2/pages?portalId={p}&limit={n}	✅ 200	2573 pages, 123KB for limit=5
+Settings
+Method	Path	Status
+GET	/api/content-settings/v1/site-settings/by-portal-id/{portal}	✅
+Portal copy (HubSpot's OWN content migration RPC)
+Method	Path	Status	Note
+GET	/api/content-portal-copy/v1/copy/status?portalId={p}	✅ 200	Empty array currently. Returns copy-job statuses. This is the entry point to HubSpot's "Content Asset Copy" feature.
+This is a major find — HubSpot has its own portal copy job system. Worth investigating in a separate iteration if we can trigger it externally.
+
+What's NOT reachable in this portal
+/api/cms/v3/... — all 404 (CMS Hub public API not enabled?)
+/api/website-pages/v3/pages — 404
+/api/file-manager/api/v3/files — 404 (try v2)
+/api/cms-domains/... + /api/cos-domains/... + /api/domains/v1/... — all 404. Domain config truly is UI-only.
+/api/membership/v3/... — 404 (membership not enabled on this portal)
+Adapter design — CMS
+Read source (CSRF):
+
+Themes: GET /api/designmanager/v1/themes
+Templates: GET /api/designmanager/v1/templates
+Modules: GET /api/designmanager/v1/modules
+Layouts: GET /api/designmanager/v1/layouts
+Pages: GET /api/content/api/v2/pages?limit=100&offset={n} — paginate
+Site settings: GET /api/content-settings/v1/site-settings/by-portal-id/{portal}
+Write to dest (NOT in scope):
+
+POST /api/designmanager/v1/{templates|modules|layouts|themes} per asset.
+Gap closed: CMS templates, modules, layouts, themes, pages all reachable. Domains remain UI-only — no API surface for cert/DNS config (likely intentional for safety).
+
+2026-06-19 — Iteration 12: Sales content body (snippets, templates, playbooks)
+Snippets ✅ (full fidelity)
+GET /api/snippets/v1/snippets?portalId={p} → 200, Array[45]
+
+Object shape:
+
+{
+  "id": <id>,
+  "portalId": <portalId>,
+  "name": "GT | <client> | Capsula informativa",
+  "shortcut": "capsula",
+  "body": "Hola Contact: {{ contact.firstname }}, ...",   // plain text
+  "htmlBody": "<div>Hola...</div>",                       // rendered HTML
+  "folderId": 471673,
+  "createdBy": <id>, "createdAt": <id>,
+  "modifiedBy": <id>, "modifiedAt": <id>,
+  "deletedAt": null, "deletedBy": null
+}
+Full body fidelity reachable. Both plain text and HTML version. Supports HubL personalization tokens ({{ contact.firstname }}).
+
+Templates (sales-templates)
+Method	Path	Status
+GET	/api/templates/v1/templates?portalId={p}	✅ 200 — works (45 templates in portal).
+POST	/api/sales-templates/v2/templates	✅ 400 (requires {name, ...} body) — create endpoint.
+POST	/api/sales-templates/v2/templates/search	✅ 400 (requires search body) — search endpoint.
+POST	/api/sales-templates/v2/templates/folder	✅ 400 — folder operations.
+GET	/api/sales-templates/v2/templates/usage?portalId={p}	✅ 200, {limit, userLimit, currentUsage} — quota check.
+Playbooks ❌
+All tried 404:
+
+/api/playbooks/v3/playbooks, /api/playbooks/v1/playbooks
+/api/playbook/v3/playbooks, /api/playbook-app/v3/playbooks
+/api/playbooks-api/v3/playbooks, /api/playbooks-internal/...
+/api/sales-content-app/v1/playbooks
+Playbooks may not be enabled on this portal, or require a different probe (chirp RPC). Gap remains — needs sandbox investigation.
+
+Sequences ❌
+All tried 404 except /api/sequences/v2/sequences which returns 405 (Method Not Allowed for GET — needs POST body):
+
+/api/sales/sequences/v3/sequences
+/api/sales-emails/sequences/v3/sequences
+/api/sales-emails-app/v3/sequences
+/api/sequences-app/v3/sequences
+Likely behind chirp RPC — com.hubspot.sales.sequences.rpc.* not yet probed.
+
+Adapter design — sales content
+Snippets: trivial — GET /api/snippets/v1/snippets → POST per snippet to dest.
+
+Templates: use POST /api/sales-templates/v2/templates/search with {} body to list, POST to create. Body shape requires investigation in sandbox.
+
+Sequences + playbooks: gap remains. Needs chirp RPC probe (sequences likely behind com.hubspot.sales.sequences.*).
+
+2026-06-19 — Iteration 13 + 14: Forecast categories + Quote e-signature + Payments
+Both forecast and quote e-signature are NOT enabled on this portal (/forecast/<portalId>/ → 404). Most expected endpoints 404:
+
+/api/forecasts/v3/*, /api/forecast/v3/*, /api/sales-forecast/* — all 404
+/api/goals/v3/goals, /api/goals-app/v3/goals, /api/sales-goals/v3/goals — all 404
+/api/forecast-categories/v3/categories — 404
+/api/quote-app/v3/quotes, /api/quotes-app/v3/quotes, /api/quotes-esign/v1/esign, /api/electronic-signatures/v1/signatures — all 404
+Quotes ARE accessible — they're a CRM object (typeId 0-14)
+Method	Path	Status	Response
+POST	/api/crm-search/search?portalId={p} body {objectTypeId:"0-14", count, requestOptions:{includeAllProperties:true}}	✅ 200	{results[], hasMore, offset, total: 37964}
+GET	/crm/v3/objects/0-14?properties=...	⚠️ requires properties param	List quotes via public API.
+Line items, products, fee — also CRM objects
+Line items: typeId 0-8
+Products: typeId 0-7
+Discounts: separate endpoint TBD
+Carts: typeId 0-114
+Orders: separate
+Payments (Stripe integration)
+Method	Path	Status	Response
+GET	/api/payments/v1/payment-accounts/eligibility?portalId={p}	✅ 200	{status, underwritingStatus, connectionType, processorType, errorCode, legacyStripeAccountCBSP, processorStatus, isEnabled}
+GET	/api/payments/v1/payment-accounts/connected-account/default?portalId={p}	✅ 200	{portalId, internalAccountId, underwritingStatus, active, state, accountType, isEnabled}
+Adapter design — quotes + forecasts
+Quotes: use CRM API (/api/crm-search/search with objectTypeId:"0-14" + properties list). For full fidelity: include all properties + associations to deals/contacts/companies/line items. Already covered by CRM adapter.
+E-signature: not enabled on this portal — needs different portal to probe. Likely behind /api/electronic-signatures-app/ or /api/cosignatures/.
+Forecast categories: not enabled on this portal. Needs Sales Hub Enterprise + Forecasting feature. Gap remains.
+Summary — 14 iterations, gaps closed
+Area	Gap before	Status after this loop
+1. Reports/Dashboards/Datasets	Fidelity unclear	✅ Closed — /api/dashboard/v2/reports/{id} returns full def; /api/reporting/v3/dataset/resolve/async for data; HubSpot has its own /api/reporting-migration/v2/reports/migrate.
+2. Workflows v4 actions	actions[] thought internal-only	✅ Closed — /api/automationplatform/v1/hybrid/{flowId} returns full def incl. actions[], triggers, branches. CSRF header pattern unlocks 401s.
+3. Service Hub	Chatflows + SLA + KB	⚠️ Partial — chatflows visible via chirp; SLA/customer portal/KB not enabled on this portal (needs different portal).
+4. Permission set assignment	Assignment endpoint found	✅ Closed — GET /api/app-users/v1/permission-sets/permission-set-user-assignments returns full map; POST PermissionSetAssignmentsRpc/assignUserToPermissionSets applies assignments.
+5. FLP replay	Capture toggle bodies	✅ Closed — POST .../allowlistings/access-state/multi-get body shape {objectTypeIds:[]} returns full state. GET .../blocklist/including-global for blocklist.
+6. Subscription types non-email	Chat/Call/Post adapter	✅ Closed — GET /api/email/public/v1/subscriptions returns ALL channels (245 in this portal: 146 Email, 19 Chat, 3 Call, 3 Post, 74 legacy).
+7. Brand kits	No public API	✅ Closed — /api/branding/v1/brand-kit, /colors, /logos, /favicons, /fonts-with-variants all reachable with CSRF.
+8. Saved sections + D&D email	Earlier 404'd	✅ Closed — /api/cosemail/v1/emails returns full email def incl. dragAndDropLayoutId, dragAndDropThemeId, flexAreas, emailBody. 18,722 emails.
+9. CTAs new builder	Endpoint shape unknown	✅ Closed — /api/ctas/v3/placements returns full list + isMigrated flag. 2,244 CTAs.
+10. Social/Ads	Partial, read-first	⚠️ Partial — Social via /api/broadcast/v2/broadcasts. Ads entirely chirp-RPC (com.hubspot.ads.rpc.*).
+11. CMS (themes/templates/domains)	Mostly UI-only	✅ Themes/templates/modules/layouts reachable via /api/designmanager/v1/*. Domains REMAIN UI-only. HubSpot has /api/content-portal-copy/v1/copy/status — its own content copy job system.
+12. Sales playbooks/snippets/templates	Body fidelity unclear	⚠️ Partial — Snippets full fidelity via /api/snippets/v1/snippets (body + htmlBody + shortcut). Templates v1 + sales-templates v2 reachable. Playbooks + Sequences gap remains (likely chirp RPC).
+13. Forecast categories	Not first-class	❌ Not enabled on this portal — needs sandbox with Sales Hub Enterprise Forecasting.
+14. Quote e-signature	No public API	❌ Not enabled on this portal. Quotes themselves accessible via CRM (/api/crm-search/search typeId 0-14, 37,964 quotes).
+🔑 Most important discovery this loop
+The CSRF pattern: read cookie hubspotapi-csrf, send as header X-HubSpot-CSRF-hubspotapi. This unlocks ALL 401-blocked internal endpoints — including the full workflow definition, permission set assignments, FLP state, brand kits, etc.
+
+const csrf = document.cookie.split('; ').find(c => c.startsWith('hubspotapi-csrf='))?.split('=')[1];
+const r = await fetch(url, { credentials: 'include', headers: { 'X-HubSpot-CSRF-hubspotapi': csrf } });
+Apply throughout the hscli adapter layer for any internal endpoint that previously returned 401.
+
+Adapter gaps still open
+These need a sandbox portal to confirm write endpoints (we stayed read-only on live):
+
+POST/PUT verbs for automationplatform/v1/hybrid (workflow import)
+Permission set user-assignment write
+FLP allowlist write
+Brand kit create
+Subscription type create
+CTA placement create
+All design-manager writes
+Snippet/template create
+These need a different portal where the feature is enabled:
+
+Service Hub: SLA policies, customer portal, KB
+Forecast categories (Sales Hub Enterprise + Forecasting)
+Quote e-signature
+Membership / gated content
+Playbooks (likely Sales Hub Enterprise)
+These remain UI-only (confirmed):
+
+CMS domain TLS / cert config (intentional safety)
+HubSpot's /api/content-portal-copy/v1/copy/* job triggering (only /status is GET-able)
+2026-06-19 — Iteration 15: Playbook + Sequence body export (gaps closed)
+Both sequence body and playbook body export confirmed working with CSRF.
+
+Sequences — full body
+Method	Path	Status	Note
+POST	/api/salescontentsearch/v2/search?portalId={p} body {query:"", limit:100, offset:N}	✅ 200	List endpoint. Returns mixed content (DOCUMENT, TEMPLATE, SEQUENCE, DOCUMENTS_FOLDER, etc.). Filter contentType === 'SEQUENCE' client-side. 1,501 items total. Paginate with offset.
+GET	/api/sequences/v3/sequences/{sequenceId}?portalId={p}	✅ 200	Full sequence body — see shape below.
+Sequence detail shape (/api/sequences/v3/sequences/{id} → {sequence, userView}):
+
+{
+  sequence: {
+    id: <id>,
+    portalId, folderId, userId,
+    name: "4th QTR Grocery Sequence",
+    active: "ACTIVE",
+    dynamic: false,
+    createdAt, updatedAt, deletedAt,
+    
+    steps: [
+      {
+        id, sequenceId, portalId,
+        stepOrder: 0,
+        actionType: "EMAIL",  // or "TASK", "FINISH_ENROLLMENT", etc.
+        delayMillis: <id>,
+        delayMillisMin, delayMillisMax,
+        branchNumber: 0,
+        emailPattern: {        // ← references a Template by ID
+          id, sequenceId, sequenceStepId,
+          templateId: <id>,
+          threadEmailToStepOrder: 0,  // reply-to-step linkage
+          activeType: "ACTIVE",
+          createdAt, updatedAt, deletedAt
+        },
+        taskPattern: null,     // populated when actionType === "TASK"
+        variants: [],
+        variantMeta: null
+      },
+      // ...
+    ],
+    
+    settings: {
+      id, sequenceId,
+      sellingStrategy: "LEAD_BASED",
+      eligibleFollowUpDays: "BUSINESS_DAYS",
+      sendWindowStartMinute: 480,    // 8:00 AM
+      sendWindowEndMinute: 1080,     // 6:00 PM
+      taskReminderMinute: 480,
+      individualTaskRemindersEnabled: false,
+      smartDelaysEnabled: false,
+      unenrollmentSettings: {
+        emailSettings: { criteria: "ALL", sellingStrategy: "LEAD_BASED" },
+        meetingSettings: { criteria: "ALL", sellingStrategy: "LEAD_BASED" }
+      }
+    },
+    
+    engagementTriggers: null,   // auto-unenroll-on-engagement config
+    dependencies: []            // what this sequence depends on
+  },
+  userView: { firstName, lastName, email }  // sequence owner
+}
+Sequence content list item shape (salescontentsearch result with contentType:"SEQUENCE")
+{
+  contentType: "SEQUENCE",
+  contentId: <id>,         // ← sequence ID for /api/sequences/v3/sequences/{contentId}
+  portalId, userId, teamId, folderId,
+  name, description, shortcut,
+  documentId: "<portalId>_101799545_2",
+  partOfAPlay: false,
+  visibleToAll: false,
+  permissionedTeamIds: [...],
+  permissionedUserIds: [...],
+  userView: { email, firstName, lastName },
+  createdAt, updatedAt, lastUsedAt
+}
+Sequence export — full pipeline
+// 1. Get all sequences (paginate salescontentsearch)
+const sequences = [];
+let offset = 0;
+while (true) {
+  const r = await fetch('/api/salescontentsearch/v2/search?portalId=<portalId>', {
+    credentials: 'include',
+    headers: { 'X-HubSpot-CSRF-hubspotapi': csrf, 'Content-Type': 'application/json' },
+    method: 'POST',
+    body: JSON.stringify({ query: '', limit: 100, offset })
+  });
+  const { results, hasMore } = await r.json();
+  sequences.push(...results.filter(r => r.contentType === 'SEQUENCE'));
+  if (!hasMore) break;
+  offset += 100;
+}
+// 2. Per sequence: get full body
+for (const seq of sequences) {
+  const r = await fetch(`/api/sequences/v3/sequences/${seq.contentId}?portalId=<portalId>`, {
+    credentials: 'include',
+    headers: { 'X-HubSpot-CSRF-hubspotapi': csrf }
+  });
+  const fullBody = await r.json();
+  // fullBody.sequence.steps[].emailPattern.templateId references templates
+  // Pull template bodies via /api/templates/v1/templates or /api/snippets/v1/snippets
+}
+Playbooks — full body (chirp RPC)
+All playbook surface is behind com.hubspot.playbooks.rpc.PlaybooksRpc chirp RPCs. Found by reading network traffic on /playbooks/{portal}/compose/{playbookId}.
+
+RPC	Body	Returns
+getPlaybookCount	{}	{count: 3, limit: 5000}
+listPlaybooks	{}	{playbooks: [...]} — full playbook bodies inline
+getLatestPlaybookVersion	{playbookId}	Latest version body
+getPlaybookVersionSummaries	{playbookId}	Version history (all versions)
+All via:
+
+POST /api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybooksRpc/{methodName}?portalId={p}
+Headers: X-HubSpot-CSRF-hubspotapi: ...
+Body: {playbookId?: number, limit?: number}
+Chirp response wrapper: {type:"data", data:{...}, correlationId}. Real payload is in .data.
+
+Playbook body shape (listPlaybooks response item)
+{
+  id: <id>,
+  portalId: <portalId>,
+  title: "FI | Playbook (Example)",
+  playbookType: "HOW_TO",                 // or "CHECKLIST" etc.
+  publicationStage: "PUBLISHED_WITH_EDITS", // or "DRAFT", "PUBLISHED"
+  engagementTypes: ["CALL"],              // CALL / MEETING / NOTE / TASK / EMAIL
+  visibleOn: ["EVERYWHERE"],
+  displayPreference: "SHOW_EVERYWHERE",
+  crmObjectId: <id>,
+  body: "{\"blocks\":[{\"key\":\"b9ife\",\"text\":\"...\",\"type\":\"unstyled\",...}]}", // Draft.js JSON
+  htmlBody: "<p>...</p><question qid=\"<id>\"></question>...",                      // rendered HTML
+  createdAt, createdBy,
+  updatedAt, updatedBy
+}
+Body format: Draft.js JSON in .body (block-by-block model), pre-rendered HTML in .htmlBody. Questions are linked via <question qid="..."> tags in htmlBody — resolve those via PlaybookQuestionsRpc/getLatestQuestionsByPlaybook.
+
+Playbook questions
+POST /api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybookQuestionsRpc/getLatestQuestionsByPlaybook?portalId={p}
+Body: { playbookId: <id> }
+→ { type: "data", data: { questions: [
+    {
+      id: <id>, portalId, playbookId,
+      state: "DRAFT",                          // or "PUBLISHED"
+      version: 1,
+      answerType: "QUICK_REPLIES",             // or "TEXT", "ENUMERATION", etc.
+      question: "What are the current challenges you are facing?",
+      quickAnswers: ["Cleanliness", "Food safety procedures", "Management", ...]
+    }
+  ]
+}}
+Playbook export — full pipeline
+// 1. List all playbooks (body included)
+const r = await fetch('/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybooksRpc/listPlaybooks?portalId=<portalId>', {
+  credentials: 'include',
+  headers: { 'X-HubSpot-CSRF-hubspotapi': csrf, 'Content-Type': 'application/json' },
+  method: 'POST',
+  body: JSON.stringify({})
+});
+const { data: { playbooks } } = await r.json();
+
+// 2. Per playbook: get questions
+for (const pb of playbooks) {
+  const qr = await fetch('/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybookQuestionsRpc/getLatestQuestionsByPlaybook?portalId=<portalId>', {
+    credentials: 'include', headers: { 'X-HubSpot-CSRF-hubspotapi': csrf, 'Content-Type': 'application/json' },
+    method: 'POST', body: JSON.stringify({ playbookId: pb.id })
+  });
+  pb.questions = (await qr.json()).data.questions;
+}
+Gaps closed
+Asset	Body export	Notes
+Sequence	✅ Full	GET /api/sequences/v3/sequences/{id} — includes steps, settings, email templates by ID, send window, unenrollment rules, dependencies
+Playbook	✅ Full	listPlaybooks RPC returns body + htmlBody inline. Plus questions via separate RPC.
+Caveat: Sequence steps reference templates by ID; full fidelity requires also fetching template bodies. Same for playbook questions.