Notion

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the pages and database rows that someone has shared with your Notion integration, so agents can answer from the team’s own wiki. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	Notion, version 1.0.0
Reads	Notion Labs: Notion API (the vendor's documentation)
Family	Knowledge
Kind	Wiki
Ways to connect	Access token
Scopes	Read:
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	Contact, Content
Hosts it may contact	api.notion.com, www.notion.so, {host}
Vendor API versions	Notion API 2022-06-28
Lowest engine version	0.46.0

What it reads

• Pages shared with the integration: the title and the text of the page’s blocks (paragraphs, headings, lists, to-dos, quotes, callouts, toggles and code), read to max_depth levels of nesting (default 3, at most 10). A child page or child database is a page of its own and is not read twice.
• Database rows: a row is a page, and comes in with its properties (text, selects, dates, numbers, checkboxes, people names, and so on). databases narrows rows to the databases you name; pages that are not rows are read whatever it says.
• Changes only: the search for pages runs newest first and stops at the first page not edited after the cursor (last_edited_time).

Only what someone shares with the integration is read. A person adds the integration to a page or database; that is the decision to let the agents read it. Images, files and embedded content are not read.

How to connect

1. In Notion, make an internal integration in your workspace.
2. Share the pages or databases you want read with it.
3. In LightHouse, open Setup and admin, Connectors, choose Notion, and (optionally) name the databases.
4. Paste the integration’s secret. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (NOTION_CREDENTIAL by default) with one field, token.

Permissions

• Notion states no capabilities for an integration, so the sharing decides what can be read. Give the integration the read content capability only.
• What the collector does: GET requests for blocks, and Notion’s search, which is only offered as a POST with the query in the body (/v1/search). Nothing is created, edited or deleted. Its read-only test proves that on every change.
• One host: api.notion.com. The collector sends the Notion-Version header 2022-06-28.

Limits

• Notion allows about three requests a second, so the collector paces itself to that, and a 429 waits as long as Notion asks (Retry-After).
• Search results are in pages of 100.
• A page’s links are kept only when they are on www.notion.so; any other address is dropped (the address is never contacted).
• A page moved to the trash, archived or no longer shared stops being found; every six hours every shared page’s id is listed and what has gone is removed from the corpus, not at once.

Data handling

• Pages and rows can hold personal data, and people’s names appear in people properties. Documents carry the label you give the source.
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the pages, and never opens the credential.
• The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.

Troubleshooting

What you see	What it means	What to do
credential variable 'NOTION_CREDENTIAL' is not set	The deployment holds no credential for this source	Connect Notion again in LightHouse
the notion credential has no token	The credential lacks its token field	Re-enter the integration secret
not Notion database ids: [...]	A database id is not 32 hexadecimal characters	Copy the id from the database’s address
Read succeeded, 0 written	Nothing is shared with the integration, or nothing changed	Share the pages with the integration in Notion
HTTP 401	The secret is wrong or revoked	Make a new integration secret
HTTP 429	Notion’s rate limit	Nothing; the collector waits as Notion asks

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Notion API 2022-06-28	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only