Trial follow-up escalation: HubSpot → Slack → Todoist

Create a private app with contact-read scope

HubSpot → Development → Legacy apps → Create legacy app → Private (some accounts still show this under Settings → Integrations → Private Apps — same feature, different label depending on the account). Scopes: crm.objects.contacts.read (required), crm.objects.contacts.write (optional — only needed if you add a step of your own to stamp a de-dupe timestamp back onto the contact; the flow below does not include that step). The token sits on the Auth tab behind "Show token".

Create the plan_tier and is_trial_contact properties

This intentionally skips hubspotscore: HubSpot froze its legacy lead-scoring tool on 2025-08-31 (existing scores stopped updating and stay pinned at whatever value they had that day), so a numeric-score filter is a dead signal for any contact who entered your pipeline afterward. Settings → Properties → Create property, on the Contact object: plan_tier (dropdown, values matching your own plan names, e.g. starter / growth / enterprise — HubSpot has no built-in "customer value" field, this is entirely this workflow's own choice, kept in sync with whatever your billing or CRM source of truth already tracks) and is_trial_contact (checkbox, set true when a contact starts a trial). Both are custom properties on the base Contact object, not a Sales Hub feature, so creating and filtering on them does not require any paid tier.

Confirm the sequence is on a paying tier

Sequences lives under its own nav item and requires Sales Hub Starter or above. If hs_sequences_is_enrolled and hs_last_sequence_ended_date read empty for every contact, check the account tier before debugging the API call — a free HubSpot account never populates these properties at all, no matter how the request is built.

Search for contacts to escalate

One CRM contacts search covers all three conditions — is_trial_contact true, hs_last_sequence_ended_date recent, plan_tier at a qualifying tier. Pull hs_sales_email_last_opened, hs_sales_email_last_replied and hs_last_sequence_enrolled_date in the same response; the engagement check on those three properties happens in code after the fetch, not as a fourth filter — HubSpot's Search API only compares a property to a literal value, so "opened before this enrollment" has no filter syntax regardless of how many filters a group allows (see the flow steps below for why "empty" alone is not enough).

curl -X POST "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -H "Authorization: Bearer $HUBSPOT_PRIVATE_APP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [
        { "propertyName": "is_trial_contact", "operator": "EQ", "value": "true" },
        { "propertyName": "hs_last_sequence_ended_date", "operator": "GTE", "value": "1723075200000" },
        { "propertyName": "plan_tier", "operator": "IN", "values": ["growth", "enterprise"] }
      ]
    }],
    "properties": [
      "email", "firstname", "lastname", "company", "hubspot_owner_id", "plan_tier",
      "hs_last_sequence_ended_date", "hs_last_sequence_enrolled_date",
      "hs_sales_email_last_opened", "hs_sales_email_last_replied"
    ]
  }'

Know what HubSpot itself already does here

On Sales Hub Professional/Enterprise, HubSpot Workflows can already branch on these same contact properties and send a native Slack notification to the record owner — the condition-check-and-alert half of this workflow is not exclusive to it. What Workflows cannot do today is hand off to Todoist: HubSpot used to ship a native "Create a task in Todoist" workflow action, but as of a 2026-07-31 update that integration is sunset and no longer accepts new installations, so a workflow set up today has no native bridge to Todoist (only third-party Zapier/Make integrations remain available), and the native path tops out at another internal HubSpot task sitting in the same CRM queue the owner already skims past. The actual value of this workflow is the last two flow steps below — a due-today Todoist task the owner cannot read-and-ignore the way they can a CRM task or a Slack DM.

Create the app and add bot scopes

api.slack.com/apps → Create New App → From scratch → OAuth & Permissions → Bot Token Scopes: chat:write (post the DM), users:read.email (resolve the HubSpot owner's email to a Slack user id). Install to the workspace to get the bot token (xoxb-..., Bearer auth).

DM without inviting the bot anywhere

Slack lets chat.postMessage address a user id directly in the channel field — that opens a one-to-one DM with no channel to create and no invite step. This only works because the target is a Slack user id, not a channel name.

Look up the user, post, then check the body — not just the status code

Slack's Web API wraps failures in an HTTP 200: a bad token or missing scope still comes back {"ok":false,"error":"..."} at status 200, so a status-code-only check treats that failure as success. Read ok from the response body on every call.

curl -s -G "https://slack.com/api/users.lookupByEmail" \
  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
  --data-urlencode "email=owner@company.com"

curl -X POST "https://slack.com/api/chat.postMessage" \
  -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
  -H "Content-Type: application/json; charset=utf-8" \
  -d '{"channel":"U0REP123","text":"Northwind (growth plan) finished the trial sequence with zero opens — worth a personal call."}'

Grab a personal API token

Todoist web app → avatar (top right) → Integrations → Developer → copy the API token (the page may still label it "API token"). Bearer auth, same token, no OAuth flow to run.

Create a dedicated project

Make a "Trial Escalation" project and copy its project_id from the URL, so these tasks land somewhere separate from anyone's personal to-do list. This is built as one rep's own forced-action list, not a team dispatcher — Todoist Free does not support assigning a task to a teammate (Todoist's own pricing page lists "Assigned tasks" only under Pro/Business, not Free/Beginner; the field is assignee_id on POST /api/v1/tasks, not the Sync API's older responsible_uid). If several reps share the project, put the owner's name in the task content instead of relying on assignment.

File the forced task

POST to /api/v1/tasks, not the old /rest/v2/tasks path — that one now returns 410 Gone. due_string takes natural language ("today", "in 4 hours"); priority runs 1 (normal) to 4 (urgent).

curl -X POST "https://api.todoist.com/api/v1/tasks" \
  -H "Authorization: Bearer $TODOIST_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "Call Northwind (Lee) — trial sequence ended, zero opens, growth plan",
    "project_id": "2203306141",
    "due_string": "today",
    "priority": 4
  }'