[URGENT] Marketplace App Cannot Call External APIs - hubspot.fetch() Not Available on Platform 2025.

[mattoess]

[URGENT] Marketplace App Cannot Call External APIs - hubspot.fetch() Not Available on Platform 2025.
TL;DR
Marketplace app UI extensions on platform 2025.2 cannot call external APIs. Despite following documentation that says to use hubspot.fetch(), this function is not available (hasFetch: false in props), and standard fetch() calls are intercepted by HubSpot's proxy returning 400 errors.

Environment
Platform Version: 2025.2
App Distribution: marketplace
App ID: 22558790
Component: Card (UI Extension)
Location: crm.record.sidebar
Object Type: contacts
Problem Description
I'm building a marketplace app with a UI extension card that needs to call my external Vercel-hosted API. According to HubSpot documentation:

"With public apps, you must support your own REST-based backend and use the hubspot.fetch() method to fetch data."

However, hubspot.fetch() is NOT available in the props provided to my UI extension.

Configuration
app-hsmeta.json:

{
"uid": "revenue_growth_agent",
"type": "app",
"config": {
"name": "Revenue Growth Agent",
"distribution": "marketplace",
"auth": {
"type": "oauth"
},
"permittedUrls": {
"fetch": [
"https://api.hubapi.com",
"https://www.revenuegrowthagent.com",
"https://ai-sales-agent-v5.vercel.app",
"https://ai-sales-agent-v5-c4v2xjatf-matt-oess-projects.vercel.app"
]
}
}
}
Card Component:

import { hubspot } from "@hubspot/ui-extensions";

hubspot.extend((props) => {
console.log('Props:', {
hasContext: !!props.context,
hasFetch: !!props.fetch, // Shows: false
hasActions: !!props.actions
});
return <MeetingPrepperCard {...props} />;
});
What Happens
Attempt 1: Using hubspot.fetch()

const response = await hubspot.fetch(API_URL, {...});
Result: hubspot.fetch is not a function (because hasFetch: false)

Attempt 2: Using standard fetch()

const response = await fetch(API_URL, {...});
Result: Request is intercepted by HubSpot's internal proxy:

POST https://app-na2.hubspot.com/api/crm-extensibility/execution/internal/v3/proxy?appId=22558790&portalId=244192832
400 (Bad Request)

Error at: proxyRequest @ crm-extensibility.ts:60
Console Output
hubspot.extend() received props (v2025.2 PUBLIC APP): {
keys: ['context', 'actions', 'runServerlessFunction'],
hasContext: true,
hasFetch: false, // hubspot.fetch() NOT available
hasActions: true
}
What I've Verified
✅ External API works perfectly (tested with curl/Postman) ✅ API has proper CORS headers configured ✅ URLs are correctly listed in permittedUrls.fetch ✅ App successfully deployed (Build #66) ✅ Card renders and displays correctly ✅ All other HubSpot API calls work fine

Documentation References
The "Navigating Serverless Functions on HubSpot's New Developer Platform" blog post states:

"With public apps, you must support your own REST-based backend and use the hubspot.fetch() method to fetch data."

But hubspot.fetch() is not provided in marketplace apps on platform 2025.2.

Questions
Is hubspot.fetch() supposed to be available for marketplace apps on platform 2025.2?
Why does the crm-extensibility proxy return 400 errors for URLs in permittedUrls?
What is the correct way to call external APIs from marketplace app UI extensions?
Is this a known platform limitation or bug?
Impact
This completely blocks marketplace app development for any app that needs to integrate with external services. We cannot:

Call our backend APIs
Integrate with third-party services
Complete workflows requiring external data
Additional Context
Card UI and all HubSpot-native features work perfectly
Props include runServerlessFunction, but serverless functions are deprecated in 2025.2
The external API endpoint is hosted on Vercel (same pattern as the example repos like hubspotdev/property-mapping-server)
Has anyone successfully called external APIs from a marketplace app UI extension on platform 2025.2? What am I missing?

Any help would be greatly appreciated! This has been blocking our development for days.

[mattoess]

[Update] CONFIRMED ROOT CAUSE: Testing in a developer test account shows HubSpot's CSP is set to 'connect-src none' despite permittedUrls.fetch being properly configured. This appears to be a platform bug in version 2025.2 where the permittedUrls configuration is not being applied to the Content Security Policy headers."

[mattoess]

Anyone seen anything similar, or am I missing something?

[19kmunz]

@mattoess This is not an avenue for developer support! HubSpot would see this quicker if you reached out through Hubspot support, or others may be able to help you in the developer slack!

hubspot.fetch is available for all types of apps in 2025.2. I am very surprised it is not showing up as an option for you! First of all !!props.fetch would be on the props returns by hubspot.extend, which does not include fetch, instead it would be on the props of the hubspot object itself. The standard fetch is not supported, calls must be made through hubspot.fetch(). Reach out through other channels and your specific setup can be dissected further.