Independent migration source review · Offline
Fictional Service Desk — legacy card source review
DEMONSTRATION — synthetic fixture, no client integration reviewed.
This report inventories supplied legacy definitions and response examples. It does not establish production compatibility or replace authenticated testing.
Documentation checked 2026-09-06 · Report generated 2026-09-06T16:58:58+00:00 · Analyzer 1.0.0
2Cards in fixture
2Response examples
6Observed actions
8Server review occurrences
Legacy card sunset. HubSpot lists October 31, 2026 as the legacy card sunset. Recheck the current announcement when planning delivery.
View migration is irreversible. Once started, replacement of user views cannot be stopped or reversed. This review performs no migration; require client test-portal evidence before considering that operation.
Card 1
Service issues — synthetic example
Title: Service issues · Source ID: demo-card-1
Objects and requested data
| Record type | Requested properties |
|---|---|
| contacts | |
| tickets | subject, hs_pipeline_stage |
Configured display properties
| Name | Label | Type |
|---|---|---|
| status | Issue status | STATUS |
| issue_url | Issue page | LINK |
Endpoints and handling inventory
Each row is an occurrence in supplied input; repeated destinations may share a handler. No request was sent. Query values and fragments are omitted.
| Use | Method | Target | Server review | Evidence pointer |
|---|---|---|---|---|
| data_fetch | GET | https://api.example.com/hubspot/issues | Required | /cards/0/definition/fetch/targetUrl |
| action_base | Unspecified | https://api.example.com/hubspot | Configuration reference | /cards/0/definition/actions/baseUrls/0 |
| action_base | Unspecified | https://app.example.com/hubspot | Configuration reference | /cards/0/definition/actions/baseUrls/1 |
| iframe | Unspecified | https://app.example.com/hubspot/issues/101/edit | Required | /cards/0/responseSamples/0/results/0/actions/0/uri |
| action_hook | PUT | https://api.example.com/hubspot/issues/101/resolve | Required | /cards/0/responseSamples/0/results/0/actions/1/uri |
| action_hook | DELETE | https://api.example.com/hubspot/issues/101 | Required | /cards/0/responseSamples/0/results/0/actions/2/uri |
| iframe | Unspecified | https://app.example.com/hubspot/issues/new | Required | /cards/0/responseSamples/0/primaryAction/uri |
| iframe | Unspecified | https://app.example.com/hubspot/settings | Required | /cards/0/responseSamples/0/settingsAction/uri |
| action_hook | POST | https://api.example.com/hubspot/refresh | Required | /cards/0/responseSamples/0/secondaryActions/0/uri |
Actions
| Location | Type | Label | Method | Requested properties |
|---|---|---|---|---|
| result | IFRAME | Edit issue | Not supplied | subject |
| result | ACTION_HOOK | Resolve issue | PUT | hs_pipeline_stage |
| result | CONFIRMATION_ACTION_HOOK | Remove issue | DELETE | None supplied |
| primaryAction | IFRAME | Create issue | Not supplied | None supplied |
| settingsAction | IFRAME | Settings | Not supplied | None supplied |
| secondaryAction | ACTION_HOOK | Refresh summary | POST |
Navigation links
| Target | Evidence pointer |
|---|---|
| https://app.example.com/issues/101 | /cards/0/responseSamples/0/results/0/link |
| https://app.example.com/issues/101 | /cards/0/responseSamples/0/results/0/issue_url |
Review findings
| Priority | Rule | Finding | Evidence pointer |
|---|---|---|---|
| unknown | PLATFORM | Project and rollout state unavailable | /cards/0 |
| unknown | PERMISSIONS | Replacement URL permissions unverified | /cards/0 |
| unknown | SAMPLES_ONLY | Samples cannot establish coverage | /cards/0 |
| medium | TITLE | Dynamic title needs an alternative | /cards/0/definition |
| high | FETCH_BACKEND | Data endpoint needs source review | /cards/0/definition/fetch/targetUrl |
| medium | APP_ID | Converter adds appId | /cards/0/definition/fetch/targetUrl |
| high | TICKET_LOCATIONS | Ticket cards need two locations | /cards/0/definition/fetch/objectTypes/1 |
| medium | LINK | Link destination untested | /cards/0/responseSamples/0/results/0/link |
| medium | LINK | Link destination untested | /cards/0/responseSamples/0/results/0/issue_url |
| high | IFRAME | Iframe behavior needs authenticated testing | /cards/0/responseSamples/0/results/0/actions/0 |
| high | ACTION_BACKEND | Action endpoint needs source review | /cards/0/responseSamples/0/results/0/actions/1 |
| medium | APP_ID | Converter adds appId | /cards/0/responseSamples/0/results/0/actions/1 |
| high | BODY_FORMAT | Action body changes in the converter | /cards/0/responseSamples/0/results/0/actions/1 |
| high | ACTION_BACKEND | Action endpoint needs source review | /cards/0/responseSamples/0/results/0/actions/2 |
| medium | APP_ID | Converter adds appId | /cards/0/responseSamples/0/results/0/actions/2 |
| high | CONFIRMATION | Preserve action confirmation | /cards/0/responseSamples/0/results/0/actions/2 |
| high | IFRAME | Iframe behavior needs authenticated testing | /cards/0/responseSamples/0/primaryAction |
| high | IFRAME | Iframe behavior needs authenticated testing | /cards/0/responseSamples/0/settingsAction |
| medium | SETTINGS | Settings presentation changes | /cards/0/responseSamples/0/settingsAction |
| high | ACTION_BACKEND | Action endpoint needs source review | /cards/0/responseSamples/0/secondaryActions/0 |
| medium | APP_ID | Converter adds appId | /cards/0/responseSamples/0/secondaryActions/0 |
| high | BODY_FORMAT | Action body changes in the converter | /cards/0/responseSamples/0/secondaryActions/0 |
Card 2
Account summary — intentionally incomplete source example
Title: Account summary · Source ID: demo-card-2
Objects and requested data
| Record type | Requested properties |
|---|---|
| companies | domain |
Configured display properties
| Name | Label | Type |
|---|---|---|
| is_active | Active account | BOOLEAN |
Endpoints and handling inventory
Each row is an occurrence in supplied input; repeated destinations may share a handler. No request was sent. Query values and fragments are omitted.
| Use | Method | Target | Server review | Evidence pointer |
|---|---|---|---|---|
| data_fetch | GET | http://legacy.example.com/account-summary | Required | /cards/1/definition/fetch/targetUrl |
Actions
None observed in the supplied fixture.
Navigation links
None observed in the supplied fixture.
Review findings
| Priority | Rule | Finding | Evidence pointer |
|---|---|---|---|
| unknown | PLATFORM | Project and rollout state unavailable | /cards/1 |
| unknown | PERMISSIONS | Replacement URL permissions unverified | /cards/1 |
| unknown | SAMPLES_ONLY | Samples cannot establish coverage | /cards/1 |
| medium | TITLE | Dynamic title needs an alternative | /cards/1/definition |
| high | HTTP | HTTP URL observed | /cards/1/definition/fetch/targetUrl |
| high | FETCH_BACKEND | Data endpoint needs source review | /cards/1/definition/fetch/targetUrl |
| medium | APP_ID | Converter adds appId | /cards/1/definition/fetch/targetUrl |
| unknown | UNKNOWN_TYPE | Property type needs manual review | /cards/1/definition/display/properties/0/dataType |
| unknown | MISSING | Review input is incomplete | /cards/1/responseSamples |
Rule notes and source references
| Rule | Review note | Source IDs |
|---|---|---|
| ACTION_BACKEND | Hook actions make server-side requests. Review authorization, request validation and side effects before adapting them. | legacy |
| APP_ID | The converter adds appId to data and action requests. Test handlers that reject unexpected parameters or rely on exact request representations. | converter |
| BODY_FORMAT | The official converter uses JSON for POST/PUT/PATCH, versus legacy form encoding. Confirm backward-compatible backend parsing; GET/DELETE use query parameters. | converter |
| CONFIRMATION | Confirmation hooks display a dialog before the request. Test cancellation, confirmation and protection against repeated side effects. | legacy |
| FETCH_BACKEND | Inventory the fetch handler, record context, data mapping and failure behavior. Its existence in a fixture does not prove reachability or correct authorization. | legacy |
| HTTP | Review an HTTPS replacement and redirect behavior before adding this target to new app URL permissions. | configuration |
| IFRAME | Legacy iframe actions do not receive the hook request signature. Review iframe authorization, framing policy, session handling and close/cancel behavior in the client test portal. | legacy |
| IRREVERSIBLE | Once started, replacement of user views cannot be stopped or reversed. This review performs no migration; require client test-portal evidence before considering that operation. | migration |
| LINK | Test navigation, permissions, redirects and target behavior with a representative user; no destination is visited by this tool. | Analyzer assessment |
| MISSING | Supply the missing source section or field. Absence from this fixture does not establish absence from the live integration. | Analyzer assessment |
| PERMISSIONS | New app configuration separates permitted fetch, iframe and image URLs, and requires HTTPS. This tool does not generate or verify that configuration. | configuration |
| PLATFORM | Verify projects framework 2025.2 or newer, installed scopes, replacement cards and applicable feature flags. The migration guide requires deleting hs-release-app-cards and hs-hide-crm-cards when applicable before view migration. | migration |
| SAMPLES_ONLY | Collect representative empty, normal, error and permission-dependent responses. No sample proves all live branches are covered. | Analyzer assessment |
| SETTINGS | The converter presents a settings button rather than the legacy footer action. Compare the customer workflow. | converter |
| SUNSET | HubSpot lists October 31, 2026 as the legacy card sunset. Recheck the current announcement when planning delivery. | sunset |
| TICKET_LOCATIONS | Ticket migration requires replacements for crm.record.sidebar and helpdesk.sidebar, with distinct titles and both replacement IDs. | migration |
| TITLE | The converter's card title is static; counts can be placed inside card content. Compare this against the legacy user experience. | converter |
| UNKNOWN_TYPE | The type is outside this analyzer's reviewed display set. This is not a declaration that HubSpot rejects it. | Analyzer assessment |
Unresolved evidence
- Actual deployed card set and source completeness
- Current project platform version, scopes, URL permissions and feature flags
- Endpoint availability, authentication, signature handling and parsing
- Tenant isolation, user permissions, performance and real response variants
- Replacement implementation, visual behavior and customer acceptance
- Client ownership, test-portal access and deployment/cutover authority
Client acceptance test plan — all tests pending
| ID | Case | Acceptance evidence | Environment | Status |
|---|---|---|---|---|
| T01 | Source completeness | Reconcile every deployed legacy card and object type against the inventory; explain missing sources and unknown fields. | Client source review | not_run |
| T02 | Record data and empty states | Compare normal, empty, missing-property, duplicate-result and large-result cases in both card locations that apply. | Client test portal | not_run |
| T03 | Backend request contracts | Capture sanitized request metadata and compare method, query, JSON/form parsing, extra parameters and request verification without storing credentials. | Client test portal and backend | not_run |
| T04 | Failure handling | Inject timeout, unreachable endpoint, 401/403, 404, 429, malformed response and 5xx; verify understandable errors and bounded retries. | Client test portal and controlled backend | not_run |
| T05 | Action integrity | Verify confirm/cancel, double click, replay and retry. A repeated request must not duplicate a charge, deletion or other irreversible effect. | Client test portal with synthetic records | not_run |
| T06 | Iframe and link flow | Test permitted targets, session expiry, framing restrictions, redirects, navigation and close/cancel with representative user permissions. | Client test portal | not_run |
| T07 | Least privilege and isolation | Test limited users, multiple installed accounts and denied record access; data and actions remain scoped to the correct account and user. | Client test portal and backend | not_run |
| T08 | Rollout evidence | Recheck current docs, replacement IDs, all locations, scope grants and flag state; record test evidence and a client-controlled cutover decision before irreversible view migration. | Client-controlled rollout review | not_run |
Sources
- migration: HubSpot: Migrate a legacy CRM card to an app card — reviewed 2026-09-06; page modified 2026-06-29
- legacy: HubSpot: Legacy CRM cards — reviewed 2026-09-06; page modified 2026-04-13
- converter: HubSpot: Official Legacy CRM Card Converter example — reviewed 2026-09-06; page modified Not supplied
- configuration: HubSpot: App configuration — reviewed 2026-09-06; page modified 2026-08-06
- cards_api: HubSpot: Retrieve all CRM cards — reviewed 2026-09-06; page modified Not supplied
- sunset: HubSpot: Deprecating support for classic/legacy CRM cards — reviewed 2026-09-06; page modified Not supplied
Limits and handling
- No account connection, code conversion, schema certification, request execution or HubSpot API mutation.
- Heuristic secret rejection is a backstop, not guaranteed sanitization. Supply synthetic or independently sanitized data only.
- This bounded review format is ours, not a HubSpot import format. Unknown fields and types require manual source review.
- Only supplied examples are inspected. Zero findings for a feature does not prove compatibility.
- Report endpoints omit query values and fragments; query-field names and path metadata remain in local output.
- The official converter is an example. Its mutable source and current documentation must be rechecked before client implementation.
Input SHA-256: fbcdbaf767c38610b3210a1e9e55d7a618374eadb57fb01e589a8ce2f2c9eed4
Get this review for your own cards.
$750 USD + applicable tax · Up to 2 cards in 1 public/unlisted app. Receive an independent, AI-assisted source review and prioritized change/test plan within 2 business days after payment is verified, complete sanitized inputs are accepted, and we confirm the start.
Full migration and production troubleshooting are excluded. Implementation is separately scoped from $4,500. Cancel before work starts for a refund.