What permissions MarqIQ asks for, tool by tool
This page lists every permission MarqIQ asks for, what each one turns on, and what stops working if you withhold it. Nothing here is a wish list — a permission is listed only where MarqIQ makes a call that needs it. Copy the rows you need straight into a security questionnaire.
How to read this page
- Required means MarqIQ cannot connect at all without it. Everything else turns on one named thing and costs you that thing when you withhold it.
- A permission marked write is one that lets MarqIQ change something in your tool. Every write to a record is started by a person from a screen. None runs on a schedule.
- Eight tools carry their own list on their connect form, under a card headed What MarqIQ needs from that tool.
- Each row was checked against the code rather than against a design document. None has yet been exercised against a live account holding exactly these permissions and no others.
Note
You create a credential inside your own tool and paste it in, so your team controls what that credential can reach before MarqIQ ever holds it. The one exception is Connect with Salesforce, where it is offered: it sends you to Salesforce to sign in and approve MarqIQ there.
HubSpot
A Private App token, or a Service Key. Both are long-lived tokens you create yourself, at app.hubspot.com/l/private-apps or app.hubspot.com/l/service-keys. There is no OAuth round trip and nothing to renew on a schedule.
| Scope | Read or write | What it turns on, and what you lose without it |
|---|---|---|
| crm.objects.contacts.read | Read — required | Everything. MarqIQ tests the token against HubSpot’s contact-properties endpoint the moment you connect and refuses the connection if HubSpot says no. |
| crm.objects.deals.read | Read | The deals themselves. Without it no deal syncs and every pipeline figure is empty. This is the scope people most often miss. |
| crm.objects.companies.read | Read | Companies, and which company each deal belongs to. |
| crm.schemas.deals.read | Read | Your custom deal properties. Without it only HubSpot’s standard deal columns sync. |
| crm.schemas.companies.read | Read | Your custom company properties, on the same terms. |
| crm.objects.owners.read | Read | Owner names, and the email each owner signs in with. Without it owners appear as ids and “my leads” cannot find you. The email is kept in your workspace’s own cache, used only to match the person signed in to their owner, and never shown. |
| forms | Read, and write when you pick forms | Your forms by name, and adding MarqIQ’s hidden tracking fields to the forms you choose. |
| automation | Write | Building the Source Tracking workflow. It is created switched off for you to review. |
| content | Write | Draft marketing emails and landing pages, and Design Manager templates, from Template Studio. MarqIQ sends no email and publishes no page. A template you push is live at once. |
| business-intelligence | Read | Traffic analytics and how many submissions each form took. |
| email-events | Read | Opens, clicks and bounces per person. |
| files | Write | Uploading an image for a template into your File Manager. The file is public. |
| crm.objects.contacts.write | Write | Writing back to contacts: filling an empty first-touch field, applying a change set you approved, and applying normalised or enriched values. Leave it off and MarqIQ reads only. |
| crm.schemas.contacts.write | Write | Creating the UTM tracking properties and their property group, instead of you adding them by hand. |
A token missing an optional scope does not break the connection. Most screens quote HubSpot’s own refusal back to you; contact property discovery falls back to the standard columns without announcing it.
MarqIQ never deletes a contact, company or deal in HubSpot. It sends no email and publishes no landing page. Three things are live as soon as you ask for them: a field added to a form, a pushed template, and an uploaded image, which is public. A change set only ever fills a property that is empty when it writes, and so does the first-touch backfill: it reads each record from HubSpot just before it writes. Normalisation and enrichment do replace values you already hold, and neither shows you every record first. What MarqIQ will never do to your data says what each one shows.
Salesforce
An access token — a session id, not a long-lived key — plus your org’s instance URL. MarqIQ acts entirely as the connected user, so what it can read and every change it writes is exactly what that user could do by hand, and Salesforce records that user as Last Modified By. A dedicated integration user is the usual choice, and it needs Salesforce’s API Enabled permission first.
| Permission | Read or write | What it turns on, and what you lose without it |
|---|---|---|
| OAuth scope: api — Manage user data via APIs | Both — required | Every call MarqIQ makes. This one scope carries reading and writing alike; what holds MarqIQ to reading is the object and field permissions below. |
| Read on Contact | Read | The connection itself. MarqIQ tests your token by describing Contact. A refused Contact describe is reported as an invalid or expired token, so a good token held by a user without Contact access looks exactly like a lapsed one. |
| Read on Lead | Read | Leads. With Contact, one of the two objects a sync will never step over — if either walk fails the whole run stops there. |
| Read on Account | Read | Companies, with industry, annual revenue, employee count and billing country. |
| Read on Opportunity | Read | Deals: the pipeline, the stage-and-amount breakdown, the forecast lab and opportunity field intelligence. |
| Read on OpportunityContactRole | Read | Which people sit on which opportunity. A refusal is logged and the sync carries on, so the join comes out thin rather than absent. |
| Read on OpportunityHistory | Read | Stage, amount, close-date and forecast-category snapshots at every change. |
| Read on OpportunityStage | Read | Your active stages in sales-process order with their configured probabilities. |
| Read on Campaign | Read | Campaign names. Without it a campaign id such as 701… stays a raw id, and this is the one gap MarqIQ does not announce. |
| Read on Organization | Read | Your org’s name and country on the connection card. Entirely optional. |
| Read on User | Read | Your users’ names and emails, to name an owner and to match the person signed in to their owner (“my leads”). The email is read when needed, not stored, and never shown. Salesforce lets every profile read User by default. |
| Read on FlowDefinitionView — View Setup and Configuration | Read | The Automations analysis. MarqIQ quotes this permission by name in its own refusal. |
| Read on FieldDefinition — View Setup and Configuration | Read | Knowing which fields have Field History Tracking switched on. A refusal here reads as "nothing is tracked". |
| Field History Tracking, plus Read on LeadHistory, ContactHistory and OpportunityFieldHistory | Read | Field discipline: who or what last changed a field. Salesforce keeps history only for fields an admin has tracked, up to 20 per object. |
| Field-Level Security: Read on each field you want synced | Read | The field values themselves. A field your profile cannot see is never asked for and never flagged as missing. |
| Replication access for getDeleted, plus recycle-bin visibility for queryAll | Read | The removals lane. Without it, records removed in Salesforce linger in MarqIQ’s copy. |
| Edit on Lead and Contact, plus Field-Level Security Edit on the fields MarqIQ writes | Write | Writing back at all — which on Salesforce means normalised and enriched values only. That is part of Enterprise and Partner, and a workspace on another plan can open it once on a 7-day feature trial. Leave it off and the connection is read-only in practice, whatever the OAuth scope allows. |
MarqIQ writes to Lead and Contact records only. Accounts and Opportunities are read-only, and no field, object, flow, campaign or report is ever created.
Take care
There is no empty-fields-only rule anywhere in the Salesforce write path. Change sets, which only ever fill an empty field, are not offered for Salesforce at all — they write to HubSpot and Marketo alone. What can reach Salesforce is normalisation and enrichment, both on Enterprise and Partner, or on a 7-day feature trial. A value you write replaces what is there, and normalising a placeholder such as "N/A" writes an empty value over it. Every write is started by a person from a screen. Enrichment writes the people you tick. Normalisation lists the first 300 records, and writes the others too if you leave them all ticked.
Pipedrive
A personal API token belonging to one Pipedrive user, from app.pipedrive.com/settings/api, plus your company domain. Pipedrive offers no scope picker, so the rows below are not boxes you tick for MarqIQ — they are what the token’s owner must be able to see and do.
| What the token’s owner needs | Read or write | What it turns on |
|---|---|---|
| A personal API token from a user who can see the whole CRM | Both — required | Everything. MarqIQ fetches that user’s profile at connect and refuses if Pipedrive says no. |
| Reading field definitions, pipelines and stages | Read | Turning a 40-character field key into the name you gave it, and an option id into its label. |
| Visibility of people and organizations | Read | Persons and Organizations. |
| Visibility of deals | Read | Deals, including archived ones on a pass of their own. |
| Visibility of activities | Read | Activities. |
| Visibility of users | Read | Your users’ names and emails, to name an owner and to match the person signed in to their owner (“my leads”). The email is read when needed, not stored, and never shown. |
| Access to the Leads Inbox | Read | Pipedrive Leads. |
| Reading the deals timeline | Read | The audit’s deal section and deal-field completeness. |
| Reading a record’s change log | Read | Forecast accuracy and Field discipline. |
| Permission to add custom fields — an admin right | Write | Creating the UTM Person fields you ask for. This is the only write in the entire Pipedrive connection. |
The token is that person: it carries their permissions and their record visibility, and it dies with their Pipedrive seat.
MarqIQ never updates or deletes anything in Pipedrive. It adds fields to Person only — never to Deal, Organization, Activity or Lead — and only the UTM fields you click to create.
Microsoft Dynamics
An Azure app registration: tenant id, client id and client secret from portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade, plus your environment URL from admin.powerplatform.microsoft.com/environments. A pasted access token is accepted as a temporary alternative and cannot be renewed.
| Permission | Read or write | What it turns on |
|---|---|---|
| The environment’s .default scope | Read — required | Every call. Dynamics issues the token against your own environment. |
| Account, Contact, Lead and Opportunity — Read at Organization depth | Read | The four tables MarqIQ syncs. Read depth below Organization returns an empty list, because the application user owns no records. |
| Organization — Read | Read | Your organisation’s name on the connection label. The connection works without it. |
| Read on table metadata — EntityDefinitions | Read | The Contact table’s text columns, for the UTM field check. |
| Change tracking, per table | Read | Reflecting deletions. With it off, MarqIQ says so for that table and leaves its own copy alone. |
| Auditing, for the environment, the table and each column | Read | Field discipline. Unaudited columns are named as untestable rather than read as never-changed. |
| View Audit History — Miscellaneous privileges on the role | Read | Reading the change history itself. |
MarqIQ never writes to Dynamics 365 at all. The only write anywhere in the Dynamics path is the token request to Azure.
Note
"Fully synced — 0 records" on Dynamics is almost always a security role whose read depth is User rather than Organization: Dynamics returns an empty list and MarqIQ has no error to report.
Zoho CRM
A Self Client from api-console.zoho.com — client id, client secret and a grant code or refresh token — plus your data-centre region.
| Scope | Read or write | What it turns on |
|---|---|---|
| ZohoCRM.modules.ALL | Both — required | Leads, Contacts, Accounts and Deals, the deleted-records feed, and the record timelines Field discipline reads. |
| ZohoCRM.settings.ALL | Both | Your field definitions, and creating the UTM text fields on the Leads module when you press a button. |
Four modules only. Activities, Tasks, Calls, Campaigns, Products and Quotes are not read.
MarqIQ cannot write a value back into a Zoho record at all, not even as a proposal. The only thing it creates is a custom field on the Leads module, and only from a button you press.
Marketo
A LaunchPoint custom service: client id, client secret and your Munchkin ID. The roles below are Marketo’s own API role permissions, granted on the role attached to that service.
| Role permission | Read or write | What it turns on |
|---|---|---|
| Read-Only Lead | Read — required | People and their fields. Without it nothing connects. |
| Read-Only Activity | Read | Field-change history, form fills, email activity and web-page visits. |
| Read-Only Assets | Read | Forms, landing pages, programs, smart campaigns and emails by name. |
| Read-Only Schema Standard Field | Read | Which person fields Marketo marks read-only, so they are kept out of the field lists you are offered. |
| Read-Write Lead | Write | The first-touch fill and applying a change set you approved. Both aim only at an empty field. A change set checks that on the live record, and the fill at the last sync. On Enterprise and Partner, or on a 7-day feature trial, also writing standardised or enriched values, which can replace one. |
| Read-Write Schema Custom Field | Write | Creating one custom person field when you press Create field. |
| Read-Write Assets | Write | Hidden tracking fields on the forms you pick, the Source Tracking smart campaign, and Template Studio drafts. |
MarqIQ never deletes a person and never deletes a Marketo field. It never sends an email and never activates a smart campaign.
Take care
Adding a hidden field to a Marketo form approves that form’s draft, which makes the change live on every page embedding it and publishes anything else sitting unapproved in that draft. Where the approval fails, MarqIQ tells you the fields were left as a draft.
Adobe Campaign
An OAuth Server-to-Server credential from developer.adobe.com/console — an API key and a client secret, or an access token — plus your tenant.
| Scope | Read or write | What it turns on |
|---|---|---|
| additional_info.projectedProductContext | Read — required | Reaching Campaign at all. Adobe uses it to decide which products the credential may call. |
| read_organizations | Read | Which Adobe organisation the credential belongs to. |
| openid, AdobeID, session | Read | Adobe’s own identity round trip when the token is minted. |
MarqIQ never writes to Adobe Campaign. Your credential may well be entitled to write; MarqIQ has no code that uses it.
Two Adobe hosts are reachable and no others: Campaign itself at mc.adobe.io, and Adobe’s identity endpoint at ims-na1.adobelogin.com. A Campaign Classic instance on your own domain is out of reach by design.
Google Tag Manager
A Google OAuth access token you generate yourself at developers.google.com/oauthplayground, plus your account id and container id from tagmanager.google.com. MarqIQ acts entirely as the Google account that generated the token.
| Scope | Read or write | What it turns on |
|---|---|---|
| www.googleapis.com/auth/tagmanager.readonly | Read — required | Connecting, and the two reads the deploy makes before it writes. |
| www.googleapis.com/auth/tagmanager.edit.containers | Write | Creating or replacing the Custom HTML tag named MP Unified Tracking. This is the write permission on your container. |
Google keeps publishing behind a separate scope that MarqIQ never asks for and never sends.
Note
Every check MarqIQ makes at connect time is a read, so a view-only token connects happily and fails only when you press Deploy.
The tools whose access is not written up here yet
Pardot (MCAE), Mailchimp, Salesforce Marketing Cloud and Adobe Journey Optimizer carry their access copy on their own connect pages instead, and each has its own article in this category. The seven early-access sources — Google Ads, Meta Ads, LinkedIn Ads, GA4, Snowflake, BigQuery and Custom API — store credentials and read nothing yet, so there is no access to declare for them beyond what you paste.
How your credentials are held
- Every credential is encrypted with AES-256-GCM before it is stored, under a key held in MarqIQ’s server configuration rather than in the database.
- The list of your connections is served without the credential column at all, so the encrypted value is not read by a screen that only needs to know what is connected.
- Nothing is shown back to you. A data-source connection shows a masked tail — four dots and the last four characters — and nothing more.
- Disconnecting deletes the stored credential immediately. Your synced records and field mappings are kept so a reconnect needs no rework.
- A credential that lapses is not renewed unless MarqIQ holds Google or Salesforce OAuth credentials of its own, and each connect screen says whether that applies to this deployment.
The guard on any URL you supply
Several connections take a host from you — a Salesforce instance URL, a Pardot API base, an Adobe Campaign tenant, a Pipedrive company domain, a Custom API base URL. Before MarqIQ sends anything to one of them it checks the destination.
- Plain http is refused. So is a URL carrying a username or a password.
- The host is resolved, and an address in a private, loopback, link-local, shared or reserved range is refused. That includes the cloud metadata address 169.254.169.254.
- A redirect away from the host you gave is not followed.
- The socket is opened against the addresses the check already vetted, so a DNS record that answers a public address to the check and an internal one to the connection cannot get through.
- A Pipedrive company domain must be one plain label. A Marketo Munchkin ID may hold only letters, numbers and hyphens. Adobe Campaign is pinned to mc.adobe.io exactly.
How to revoke access from your own tool
Disconnecting inside MarqIQ deletes the credential MarqIQ holds. Revoking inside your own tool kills the credential everywhere, which is the stronger action and the one a security review usually wants. Deleting it there stops MarqIQ at once, whatever MarqIQ’s own record says.
| Tool | What to remove |
|---|---|
| HubSpot | Delete the private app, or the service key, under Settings → Integrations. |
| Salesforce, Pardot (MCAE) | Revoke the connected app’s access under Setup, or end the session the token belongs to. |
| Pipedrive | Regenerate the personal API token on the API tab of that user’s personal preferences. The old token dies at once. |
| Zoho CRM | Revoke the Self Client’s refresh token in the API Console. Disconnecting in MarqIQ does not do this for you. |
| Microsoft Dynamics | Delete the client secret, or the app registration itself, in the Azure portal. |
| Marketo | Delete the LaunchPoint custom service under Admin → Integration → LaunchPoint. |
| Adobe Campaign, Adobe Journey Optimizer | Delete the OAuth Server-to-Server credential in the Adobe Developer Console project. |
| Google Tag Manager | Remove MarqIQ’s access from the Google account whose token you pasted, or remove that account from the container. |
Anything MarqIQ created inside your tool — a property, a hidden form field, a workflow, a GTM tag — stays yours and stays where it is. Removing it is a manual step in that tool.
What MarqIQ never does, on every tool
- It never deletes one of your records. The removals lane only reads your tool’s own deletion log and marks the matching records gone in MarqIQ’s copy.
- It never sends an email, publishes a landing page, activates an automation or publishes a GTM container.
- It never writes to a record on a schedule. The scheduled sync only reads, and for Adobe Journey Optimizer it creates the export it reads from.
- It never asks for your password. Only Connect with Salesforce sends you to your tool to sign in, and there it is Salesforce that asks. Connect Slack, under Agents, also sends you to Slack to approve the MarqIQ app; Slack is where agent reports go, not a tool MarqIQ reads.
Next steps
Related articles
Was this article helpful?