{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:f94358e3c57b6e575ca58c8031b9b7552cbfdb411f937b8ecdc3b042c4980a77", "snapshot_id": "sha256:0679a3f0d41c0733e76d10ab3fb1b331811893c7d428749740ec0f21ac731d3e", "artifact_sha256": "sha256:7472396c2449279d33e7a0fb2426f02a89991501262d1db8c04c81d57bdf9021", "data": { "entity_id": "ent_01kyyts97tbppvx69rh3v86sk2", "entity_slug": "notion", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xd8y5ms1v7q3kc9pg2", "entity_id": "ent_01kyyts97tbppvx69rh3v86sk2", "scope": { "product": { "key": "notion-api", "name": "Notion API" }, "funnel": { "key": "api-integration-lifecycle", "name": "API integration lifecycle" } }, "catalog_binding": { "base_release_id": "sha256:cad9f851ab1bb553246eb2fb2b2803a4741814a33ccf28997014247439b9013d", "entity_revision_digest": "sha256:aed07956a0adbd374c3374b8958b14be3247c0acaf541ab9f0037cdb50598d7c" }, "declaration_revision_digest": "sha256:0b0b1427363816a70b6ee3af37b30d24465c95989bbdc7b37357e2a52c4a95d1", "declaration": { "declaration_id": "declaration_notion_api_integration_lifecycle", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "62b512f0c49352e55a399ba53866a5effa431d71", "path": "vendors/no/notion.yaml", "git_blob_oid": "05dffc5a46663ff3d5d5be7a8a5defd1bde583b4", "blob_digest": "sha256:ddb50ec8233090b3fdfc27c5d9dfc33d4ece28364026f1a3a1f25e1247789c26" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create and manage workspace pages through the Notion API", "interface_ids": [ "content-api" ] } ], "participants": [ { "participant_id": "notion", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyyts97tbppvx69rh3v86sk2" } } ], "resources": [ { "resource_id": "api-overview", "uri": "https://developers.notion.com/guides/get-started/overview", "roles": [ "discovery", "documentation", "eligibility", "operations" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "authorization", "uri": "https://developers.notion.com/guides/get-started/authorization", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "create-page", "uri": "https://developers.notion.com/reference/post-page.md", "roles": [ "documentation", "operations" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://www.notion.com/pricing", "roles": [ "pricing" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "quickstart", "uri": "https://developers.notion.com/guides/get-started/quick-start", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "request-limits", "uri": "https://developers.notion.com/reference/request-limits", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://www.notion.com/help/upgrade-or-downgrade-your-plan", "roles": [ "checkout", "documentation", "terms" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "status-codes", "uri": "https://developers.notion.com/reference/status-codes", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://www.notion.com/help/category/connections/all", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "resource_id": "workspace-signup", "uri": "https://app.notion.com/signup", "roles": [ "access" ], "operated_by_participant_id": "notion", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "notion-api", "uri": "https://api.notion.com/v1", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "endpoint_id": "oauth-token", "uri": "https://api.notion.com/v1/oauth/token", "transport": "http", "roles": [ "authorization", "token" ], "operated_by_participant_id": "notion", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "implements" } ] }, { "endpoint_id": "registration", "uri": "https://app.notion.com/signup", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "notion", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "content-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "notion-api" ], "resource_ids": [ "api-overview", "create-page", "quickstart", "request-limits", "status-codes" ], "operated_by_participant_id": "notion", "standard_bindings": [] }, { "interface_id": "integration-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [ "oauth-token" ], "resource_ids": [ "authorization" ], "operated_by_participant_id": "notion", "standard_bindings": [ { "namespace": "oauth", "version": "2.0", "relation": "uses" } ] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "integration-authentication" }, "to": { "node_kind": "interface", "node_id": "content-api" } }, { "relation_id": "overview-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-overview" }, "to": { "node_kind": "interface", "node_id": "content-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "workspace-signup" }, "to": { "node_kind": "interface", "node_id": "integration-authentication" } }, { "relation_id": "status-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "status-codes" }, "to": { "node_kind": "interface", "node_id": "content-api" } } ], "surface_exclusions": [] }, "lifecycle": "active", "effective_from": "2026-08-20T14:33:24.000Z", "revision_digest": "sha256:2cd5842bef0e4e2646f4fd8ae34537d71cde7497ac931aa4f400192ca8ee6aa7", "policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "policy_version": "service-use-2026-08-20-public-evidence-r9", "policy_as_of": "2026-08-20T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "C+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect actual Blocked stages by lifecycle severity.", "coverage_rule": "Every core graded metric must have supported, fresh, non-conflicting evidence. Barrier checks constrain the report when verified and cap an otherwise higher grade at B+ while unverified.", "outcome_rule": "Each stage takes its worst core metric or verified barrier, and the overall grade is derived from the five stage states plus the explicit unverified-barrier cap." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "evaluate", "stage_label": "Evaluate", "public_state": "limited", "finding": { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "context": "The documentation identifies that the Master Subscription Agreement governs Notion subscriptions for organizations and Personal Use Terms of Service governs personal use, but the full terms text is not provided in the capture." } }, "limitations": [ { "stage": "evaluate", "stage_label": "Evaluate", "finding": { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "context": "The documentation identifies that the Master Subscription Agreement governs Notion subscriptions for organizations and Personal Use Terms of Service governs personal use, but the full terms text is not provided in the capture." }, "remediation": { "signal_code": "terms_access", "code": "improve.evaluate.terms_access", "instruction": "Publish complete applicable terms at a stable public URL." } }, { "stage": "evaluate", "stage_label": "Evaluate", "finding": { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "context": "Notion defines eligibility parameters for internal connections, public connections, and personal access tokens. Public connections require an explicit installation scope choice (any workspace or selected workspaces) and must undergo a Notion security review to be listed on the Marketplace, but full eligibility criteria for all workspace roles and accounts are not completely specified." }, "remediation": { "signal_code": "eligibility_decidability", "code": "improve.evaluate.eligibility_decidability", "instruction": "State every material eligibility condition and required input explicitly." } }, { "stage": "evaluate", "stage_label": "Evaluate", "finding": { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "The pricing model is visible but omits a material variable or condition.", "context": "Notion publishes workspace plan pricing, but the retained evidence does not explicitly isolate the API usage price or no-charge status." }, "remediation": { "signal_code": "pricing_decidability", "code": "improve.evaluate.pricing_decidability", "instruction": "Publish readable complete pricing or explicit no-charge status and conditions." } }, { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "The access route works but is conditional, tenant-specific, or unstable.", "context": "The canonical HTTPS signup route resolves to Notion and exposes first-party metadata, but the capture does not establish the complete rendered start flow." }, "remediation": { "signal_code": "access_entrypoint_stability", "code": "improve.sign_up.access_entrypoint_stability", "instruction": "Publish one stable canonical access bootstrap entrypoint." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "Notion documents that connections exchange an authorization code for an access_token via a POST request to /v1/oauth/token. However, obtaining the initial credentials (CLIENT_ID and CLIENT_SECRET) requires retrieving them manually from the Developer portal." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Notion documents error codes, rate limits, and retry guidance, but not complete idempotency, cancellation, and reconciliation semantics." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Notion documents token lifecycle support for refreshing access tokens via POST requests to /v1/oauth/token with a refresh_token, returning a new access token and refresh token. Complete lifecycle management including revocation, compromise, and recovery is not fully documented in the provided text." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "context": "The documentation identifies that the Master Subscription Agreement governs Notion subscriptions for organizations and Personal Use Terms of Service governs personal use, but the full terms text is not provided in the capture." }, "secondary_context": [ { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "context": "Notion defines eligibility parameters for internal connections, public connections, and personal access tokens. Public connections require an explicit installation scope choice (any workspace or selected workspaces) and must undergo a Notion security review to be listed on the Marketplace, but full eligibility criteria for all workspace roles and accounts are not completely specified." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "The pricing model is visible but omits a material variable or condition.", "context": "Notion publishes workspace plan pricing, but the retained evidence does not explicitly isolate the API usage price or no-charge status." }, { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "Notion API documentation provides stable public entrypoints, including a documentation index at /llms.txt, API Reference, and Quickstart guide." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Only some material eligibility conditions are decidable before commitment.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:18.693Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-overview" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c332c9cfb9a9cc24136d72d0ca6afbf59195c093713e7af51afa13c97e45e44", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9d2b937244f7f324288c2432195a209b895bc8dd777e0b6b4db6f0033c5c775f", "sha256:b540c79cac1413d30d12efda86064304088030af7f986afe47027e3e99bd00ec" ], "source_surface": { "node_kind": "resource", "node_id": "api-overview" }, "locators": [ { "artifact_digest": "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "start_byte": 7686, "end_byte": 8492, "value_digest": "sha256:3b05ecdfbf99e25184732ca05ba647fd29360d9c339283bb0906d7bfa019b774" }, { "artifact_digest": "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "start_byte": 8493, "end_byte": 9295, "value_digest": "sha256:2d528d116035c040d453809e61ab5d89caa155f934ea9cab3faf302dd5b5d776" } ] } ], "note": "Notion defines eligibility parameters for internal connections, public connections, and personal access tokens. Public connections require an explicit installation scope choice (any workspace or selected workspaces) and must undergo a Notion security review to be listed on the Marketplace, but full eligibility criteria for all workspace roles and accounts are not completely specified.", "remediation": { "signal_code": "eligibility_decidability", "code": "improve.evaluate.eligibility_decidability", "instruction": "State every material eligibility condition and required input explicitly." } }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "The pricing model is visible but omits a material variable or condition.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:15.284Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e05e1fbc5174461b3a62e70149eaf305459417bcd32b8c6cab49bdfd228152bb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:75a6e9b0455f448a58a8cfb32ad75fecdb682c2c259026c923174cf69326f5dd", "sha256:a7f670e9240de413175d812050222cb08bc23cbc0aae7d73ef6079819bacf170", "sha256:db35dced3e575b0900acd643edccd85beb5d8cbd4d996afc35ab729828b0d37b" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:a7f670e9240de413175d812050222cb08bc23cbc0aae7d73ef6079819bacf170", "start_byte": 5583, "end_byte": 6375, "value_digest": "sha256:aabd62fa1bcb0e8f27d70ba7d7c0d23388dbbb582c5182ef4ba7cfddf0f3da12" } ] } ], "note": "Notion publishes workspace plan pricing, but the retained evidence does not explicitly isolate the API usage price or no-charge status.", "remediation": { "signal_code": "pricing_decidability", "code": "improve.evaluate.pricing_decidability", "instruction": "Publish readable complete pricing or explicit no-charge status and conditions." } }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:18.693Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-overview" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c332c9cfb9a9cc24136d72d0ca6afbf59195c093713e7af51afa13c97e45e44", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9d2b937244f7f324288c2432195a209b895bc8dd777e0b6b4db6f0033c5c775f", "sha256:a9fdc2bca8a690e1117355d39052f882ffdfa460bb975a7fab182f25b75abb84" ], "source_surface": { "node_kind": "resource", "node_id": "api-overview" }, "locators": [ { "artifact_digest": "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "start_byte": 11706, "end_byte": 12518, "value_digest": "sha256:e0c94b61f58f0d8813b4207102e8dc8b2d52a5a9e4a8c69ce53857256a047c57" }, { "artifact_digest": "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "start_byte": 5282, "end_byte": 6080, "value_digest": "sha256:c85037e0f21382de5fbc213dc137a3b3d93143cc42d85706aa7de36694922173" } ] } ], "note": "Notion API documentation provides stable public entrypoints, including a documentation index at /llms.txt, API Reference, and Quickstart guide." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "terms_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Terms are readable but materially incomplete, ambiguous, contextual, or unstable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:35.064Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ec357b0d4b0a5cb2f8e9489acbb1fea8f9188b0fb4ed67e1f97fb886f476f576", "capture_rung": "http" } ], "artifact_digests": [ "sha256:00eb04836b5e9978cfc2dc5a915ca508bc8d6717e2404a92c10f8d9c28fd2ed1", "sha256:36f74b4e85322ec92ce8a1a8a0aead57336bc5490fe3c14687e0a20e43e8e384", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7172381371166a5e23c76c3c261ea8d5654471874866eb91dc4cba9e81a7e928" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:7172381371166a5e23c76c3c261ea8d5654471874866eb91dc4cba9e81a7e928", "start_byte": 11557, "end_byte": 12361, "value_digest": "sha256:bcfc0c3072941ccecb2a10dea79bd8f986900ea55a4acba69190cebe5dbc0bd3" } ] } ], "note": "The documentation identifies that the Master Subscription Agreement governs Notion subscriptions for organizations and Personal Use Terms of Service governs personal use, but the full terms text is not provided in the capture.", "remediation": { "signal_code": "terms_access", "code": "improve.evaluate.terms_access", "instruction": "Publish complete applicable terms at a stable public URL." } }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] } ], "blockers": [], "remediations": [ { "signal_code": "terms_access", "code": "improve.evaluate.terms_access", "instruction": "Publish complete applicable terms at a stable public URL." }, { "signal_code": "eligibility_decidability", "code": "improve.evaluate.eligibility_decidability", "instruction": "State every material eligibility condition and required input explicitly." }, { "signal_code": "pricing_decidability", "code": "improve.evaluate.pricing_decidability", "instruction": "Publish readable complete pricing or explicit no-charge status and conditions." } ] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "The access route works but is conditional, tenant-specific, or unstable.", "context": "The canonical HTTPS signup route resolves to Notion and exposes first-party metadata, but the capture does not establish the complete rendered start flow." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence for app.notion.com/signup consists of metadata and an incomplete content shell ('Notion'), which does not contain actionable registration form controls, fields, or validation handoffs." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured evidence for the signup pages contains only metadata and minimal content shells, which do not show or explicitly declare whether a CAPTCHA challenge is present or absent." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained signup page evidence provides metadata showing format-detection telephone=no, but does not explicitly detail phone verification steps or resumable handoff behavior." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "Notion explicitly documents authorization flows including public connections using OAuth 2.0 with access tokens and refresh tokens, as well as token refresh mechanics via POST requests to https://api.notion.com/v1/oauth/token." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:48.263Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The retained evidence for app.notion.com/signup consists of metadata and an incomplete content shell ('Notion'), which does not contain actionable registration form controls, fields, or validation handoffs." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is there a stable route to begin obtaining service access?", "finding": "The access route works but is conditional, tenant-specific, or unstable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:48.263Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "workspace-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:43ea9d93cd9e051083597af2b815cad4d7e754609ea7a1f9fd7e87095e1d6e25", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:11f683febb9f6c694d3f90a622d1d6b2dececd130973b986d05b7b0b82f46f33", "sha256:48444cdee186ee102b8502f2343234049607c2b70ede52c5cd1b2e6076404ebf", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8ccf96d988b229848487f229a1066af410d4b04a3281cba6f9fd782930b704a9", "sha256:d134c16ede5c2c2499a94aa8fd9d63419599e3303bba4ec8b358575e2bad3606", "sha256:ec9cc55a55da926d50aae48ffda14c074be11f677c4b9a8eadb0880b5df1d149" ], "locators": [ { "artifact_digest": "sha256:d134c16ede5c2c2499a94aa8fd9d63419599e3303bba4ec8b358575e2bad3606", "start_byte": 0, "end_byte": 797, "value_digest": "sha256:18030fa24e6b952813a2163d032588c62450619f671b55a6fd034a70a2f8a4d0" } ] } ], "note": "The canonical HTTPS signup route resolves to Notion and exposes first-party metadata, but the capture does not establish the complete rendered start flow.", "remediation": { "signal_code": "access_entrypoint_stability", "code": "improve.sign_up.access_entrypoint_stability", "instruction": "Publish one stable canonical access bootstrap entrypoint." } }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:48.263Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "workspace-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The captured evidence for the signup pages contains only metadata and minimal content shells, which do not show or explicitly declare whether a CAPTCHA challenge is present or absent." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:18.677Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authorization" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a50ce48a396dd3d57beb7c812be2ae1d258b45a9b34c27622cee697a542b48e3", "capture_rung": "http" } ], "artifact_digests": [ "sha256:34bb1fb7c92ae6b616368546065720ee3d76b691c072444ee922b9c574101aca", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "sha256:cf3acbe82a6725ab1637cbf5278f2de2a854ccbed7b465db726171f80fc9bc13" ], "source_surface": { "node_kind": "resource", "node_id": "authorization" }, "locators": [ { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 27002, "end_byte": 27798, "value_digest": "sha256:f5b7c91be28f1dbc3cb8aa906b3a300b5d21620694755a98f87f768e22361f2b" }, { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 8195, "end_byte": 8993, "value_digest": "sha256:bb0c5fbcdfc0d55fb252472cb2ba1ba7dcc493ab855981d2af6af3679eb76cdb" } ] } ], "note": "Notion explicitly documents authorization flows including public connections using OAuth 2.0 with access tokens and refresh tokens, as well as token refresh mechanics via POST requests to https://api.notion.com/v1/oauth/token." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:48.263Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "workspace-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The retained signup page evidence provides metadata showing format-detection telephone=no, but does not explicitly detail phone verification steps or resumable handoff behavior." } ], "blockers": [], "remediations": [ { "signal_code": "access_entrypoint_stability", "code": "improve.sign_up.access_entrypoint_stability", "instruction": "Publish one stable canonical access bootstrap entrypoint." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "context": "Notion's pricing page discloses commercial commitments prior to authorization, specifying plan prices starting at $0 USD per member/month with options to select monthly or yearly payment modes." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained documentation describes upgrading a Notion plan via workspace settings and clicking 'Upgrade now', but it does not establish deterministic API or agent flow controls, approval handoff mechanisms, or programmatic resumption after approval." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "While Notion documents supported payment methods including debit/credit cards, Apple Pay, and Google Pay processed via Stripe, the evidence does not detail a documented rail for scoped delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "Notion documents a direct self-service upgrade path where workspace users can navigate to Settings -> Upgrade plan, select a plan, review the order summary, and click 'Upgrade now' to immediately activate paid access without a vendor review or decision point." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:35.064Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [], "note": "The retained documentation describes upgrading a Notion plan via workspace settings and clicking 'Upgrade now', but it does not establish deterministic API or agent flow controls, approval handoff mechanisms, or programmatic resumption after approval." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "Charge or no-charge status, currency, recurrence, and material conditions are disclosed.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:15.284Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e05e1fbc5174461b3a62e70149eaf305459417bcd32b8c6cab49bdfd228152bb", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:75a6e9b0455f448a58a8cfb32ad75fecdb682c2c259026c923174cf69326f5dd", "sha256:a7f670e9240de413175d812050222cb08bc23cbc0aae7d73ef6079819bacf170", "sha256:db35dced3e575b0900acd643edccd85beb5d8cbd4d996afc35ab729828b0d37b" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:a7f670e9240de413175d812050222cb08bc23cbc0aae7d73ef6079819bacf170", "start_byte": 5583, "end_byte": 6375, "value_digest": "sha256:aabd62fa1bcb0e8f27d70ba7d7c0d23388dbbb582c5182ef4ba7cfddf0f3da12" } ] } ], "note": "Notion's pricing page discloses commercial commitments prior to authorization, specifying plan prices starting at $0 USD per member/month with options to select monthly or yearly payment modes." }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:35.064Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [], "note": "While Notion documents supported payment methods including debit/credit cards, Apple Pay, and Google Pay processed via Stripe, the evidence does not detail a documented rail for scoped delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:35.064Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ec357b0d4b0a5cb2f8e9489acbb1fea8f9188b0fb4ed67e1f97fb886f476f576", "capture_rung": "http" } ], "artifact_digests": [ "sha256:00eb04836b5e9978cfc2dc5a915ca508bc8d6717e2404a92c10f8d9c28fd2ed1", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7172381371166a5e23c76c3c261ea8d5654471874866eb91dc4cba9e81a7e928", "sha256:d8a8181ffa9d3b34ac7e8838efb21681ceacab07d2ac334371cd3973d1f670a6" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:7172381371166a5e23c76c3c261ea8d5654471874866eb91dc4cba9e81a7e928", "start_byte": 13969, "end_byte": 14774, "value_digest": "sha256:c19f42d4ef3a05e2497d1f796fd11a97602b8c67026746340fea3329639eabdd" } ] } ], "note": "Notion documents a direct self-service upgrade path where workspace users can navigate to Settings -> Upgrade plan, select a plan, review the order summary, and click 'Upgrade now' to immediately activate paid access without a vendor review or decision point." } ], "blockers": [], "remediations": [] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "Notion documents that connections exchange an authorization code for an access_token via a POST request to /v1/oauth/token. However, obtaining the initial credentials (CLIENT_ID and CLIENT_SECRET) requires retrieving them manually from the Developer portal." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Page creation can be initiated programmatically by sending a POST request to https://api.notion.com/v1/pages with the required JSON payload and authorization token." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "Creating a page via a synchronous POST request returns a page object containing the page id and URL upon success, or a JSON error object with status, code, and message upon failure." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:18.677Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authorization" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a50ce48a396dd3d57beb7c812be2ae1d258b45a9b34c27622cee697a542b48e3", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:898441d95bda1c903cba05a02777d2805324420562ba923339ca88e4b2114003", "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "sha256:cf3acbe82a6725ab1637cbf5278f2de2a854ccbed7b465db726171f80fc9bc13" ], "source_surface": { "node_kind": "resource", "node_id": "authorization" }, "locators": [ { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 21671, "end_byte": 22470, "value_digest": "sha256:7c84a4332edda90e5cf6a6b4836570c3f666351f36502569db5964cd6fd31e6d" }, { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 22471, "end_byte": 23197, "value_digest": "sha256:5a04da189afa45fe27dd25784ef71a085c8a56dde9873eedda1a26ec0d2efb41" } ] } ], "note": "Notion documents that connections exchange an authorization code for an access_token via a POST request to /v1/oauth/token. However, obtaining the initial credentials (CLIENT_ID and CLIENT_SECRET) requires retrieving them manually from the Developer portal.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:00.549Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "quickstart" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5d8cf4b98ee682dd8f5a17dbc37e3d6bde3479088d3e65afdcb823250d73074b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9709c75c7333c42b3bb18d76cff8aa58a63ff2251ec23d79927ee314a05e8579", "sha256:c3a11795116657dec360c3b8e8a35ac89d7f68e312e154d851720f6eefe4b759", "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "start_byte": 9932, "end_byte": 10725, "value_digest": "sha256:cb9475a6df0de258a3da35edb4d112c17c53963d1aa5d5561ac9e8d9546ffb0e" }, { "artifact_digest": "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "start_byte": 6775, "end_byte": 7577, "value_digest": "sha256:e151645dcab5704554c78cc24415bbe55405e08303c952eeecf988fe26d47a42" } ] } ], "note": "Creating a page via a synchronous POST request returns a page object containing the page id and URL upon success, or a JSON error object with status, code, and message upon failure." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:00.549Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authorization" }, { "node_kind": "resource", "node_id": "quickstart" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5d8cf4b98ee682dd8f5a17dbc37e3d6bde3479088d3e65afdcb823250d73074b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c3a11795116657dec360c3b8e8a35ac89d7f68e312e154d851720f6eefe4b759", "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "sha256:fda880740a25f3573e00f0ad6e29150b81b7c196f803a3d042c8cd29413a3f03" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "start_byte": 6775, "end_byte": 7577, "value_digest": "sha256:e151645dcab5704554c78cc24415bbe55405e08303c952eeecf988fe26d47a42" }, { "artifact_digest": "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "start_byte": 7578, "end_byte": 8379, "value_digest": "sha256:7e2af297c76aafe93ad83fb68706e857734ec10f8c0c372f5a78a47556060edd" } ] } ], "note": "Page creation can be initiated programmatically by sending a POST request to https://api.notion.com/v1/pages with the required JSON payload and authorization token." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Notion documents error codes, rate limits, and retry guidance, but not complete idempotency, cancellation, and reconciliation semantics." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Notion documents token lifecycle support for refreshing access tokens via POST requests to /v1/oauth/token with a refresh_token, returning a new access token and refresh token. Complete lifecycle management including revocation, compromise, and recovery is not fully documented in the provided text." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every assessed target is accessible via a usable machine-operable interface, including the Notion REST API and the official JavaScript SDK (@notionhq/client)." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Request-time authentication with scoped authority is documented using Bearer tokens (including internal connection tokens and Personal Access Tokens) in the Authorization header along with the Notion-Version header." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Notion documents stable operation contracts across its API endpoints, including input parameters, JSON request bodies, HTTP headers, response schemas, async task handling, rate limits, and error status codes." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:18.677Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authorization" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a50ce48a396dd3d57beb7c812be2ae1d258b45a9b34c27622cee697a542b48e3", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6a0953a40650dfa09c3330ec5c4649789778cab3f369062f7ffeac86b3bfb54a", "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "sha256:cf3acbe82a6725ab1637cbf5278f2de2a854ccbed7b465db726171f80fc9bc13" ], "source_surface": { "node_kind": "resource", "node_id": "authorization" }, "locators": [ { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 27002, "end_byte": 27798, "value_digest": "sha256:f5b7c91be28f1dbc3cb8aa906b3a300b5d21620694755a98f87f768e22361f2b" }, { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 27799, "end_byte": 28576, "value_digest": "sha256:68819d471ef53ae07ba92e7b72b5161ebe07c3bd4e3800259c387165cd6188a2" } ] } ], "note": "Notion documents token lifecycle support for refreshing access tokens via POST requests to /v1/oauth/token with a refresh_token, returning a new access token and refresh token. Complete lifecycle management including revocation, compromise, and recovery is not fully documented in the provided text.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:30.482Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "status-codes" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b4e6e70cac193964540736daa3e6aba322e7bfac9abb7134defb57c68f616277", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0d37fdbec72835cd3756d7ce6092e8d9b1f7a279a709720e4f5a455b890fc3fc", "sha256:26dfaae4828c88b494085ac5dcf0ae37f118d44ac6689070373224c3eeb2e597", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62" ], "source_surface": { "node_kind": "resource", "node_id": "status-codes" }, "locators": [ { "artifact_digest": "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62", "start_byte": 7698, "end_byte": 8496, "value_digest": "sha256:c2656ffa244d8a074029754a93d22cd401c07669e5e2aaaadd1f236dea6dcb9a" }, { "artifact_digest": "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62", "start_byte": 9293, "end_byte": 9737, "value_digest": "sha256:1d9abc942ca68be40b46274ed2ded52c0d7b62f0bb8a15b9b8923bbdea762619" } ] } ], "note": "Notion documents error codes, rate limits, and retry guidance, but not complete idempotency, cancellation, and reconciliation semantics.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:18.677Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authorization" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a50ce48a396dd3d57beb7c812be2ae1d258b45a9b34c27622cee697a542b48e3", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "sha256:932a6a7c473df0b5be08cd9f6aebc741ef82b55180d41258ed6586de84caff79", "sha256:cf3acbe82a6725ab1637cbf5278f2de2a854ccbed7b465db726171f80fc9bc13" ], "source_surface": { "node_kind": "resource", "node_id": "authorization" }, "locators": [ { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 11267, "end_byte": 12066, "value_digest": "sha256:4de212f07de31e89f93c9fce8ec8354eee8c138aba05e498ff886b8d553fe82e" }, { "artifact_digest": "sha256:8a06fc5d152e7b078a0cdbd55e1cf30c00dba9f3f5f92c30910f1886e09dff72", "start_byte": 12067, "end_byte": 12870, "value_digest": "sha256:6e09e7d6985faa21e44561d70db102d7319a6e8ae5d43da1ea35d57ce8661552" } ] } ], "note": "Request-time authentication with scoped authority is documented using Bearer tokens (including internal connection tokens and Personal Access Tokens) in the Authorization header along with the Notion-Version header." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:00.874Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "content-api" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c332c9cfb9a9cc24136d72d0ca6afbf59195c093713e7af51afa13c97e45e44", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9d2b937244f7f324288c2432195a209b895bc8dd777e0b6b4db6f0033c5c775f", "sha256:edbc75b9a7a8608af2d8b4953060defdf279c722ad44f9d7bbdbb4668d94f311" ], "source_surface": { "node_kind": "resource", "node_id": "api-overview" }, "locators": [ { "artifact_digest": "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "start_byte": 6081, "end_byte": 6882, "value_digest": "sha256:6dda9777a5bb0bb2a6d48080faf866ef0c582bee2034ad11bf6ca5ef1fac0de3" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b4e6e70cac193964540736daa3e6aba322e7bfac9abb7134defb57c68f616277", "capture_rung": "http" } ], "artifact_digests": [ "sha256:26dfaae4828c88b494085ac5dcf0ae37f118d44ac6689070373224c3eeb2e597", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:e124ccf53465717c45566ba600cd162cb725bc4448c31940c1b16fa4f315e26d", "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62" ], "source_surface": { "node_kind": "resource", "node_id": "status-codes" }, "locators": [ { "artifact_digest": "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62", "start_byte": 5296, "end_byte": 6099, "value_digest": "sha256:1e3deba2b94bdb22f7dee04036adde7d0eeae27e0c8192ed0295bad56ee8484e" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:670f0b3f02f84ac6b2f7ec2b20f45fcb7ed77fa36d9dd333a0a3cdfbb1214084", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3ce39e9f862b40f48617eb236a9cde77c2eb9f530c3e019c67498018e1a0beee", "sha256:462d00961786b365df4b0b76cce2361203abd2d5a933c216ebe062628d8d4f1a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:d437da14c781e94b76199d39210c39aec142a6d6827485d4bd45f3e739d98b66" ], "source_surface": { "node_kind": "resource", "node_id": "create-page" }, "locators": [ { "artifact_digest": "sha256:d437da14c781e94b76199d39210c39aec142a6d6827485d4bd45f3e739d98b66", "start_byte": 7089, "end_byte": 7873, "value_digest": "sha256:46fd9e3bb1cec9abbfc4dc25e71dd7c2c62b965c8f93c5e0c3c2b4ed5bf64f15" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1a9aa76d948b953a348c64782503ba2bd99795652ca76ace22799287c924a320", "capture_rung": "http" } ], "artifact_digests": [ "sha256:029d1b51e3e3e9e706b97fb99b10ba4f44eaf497afc521ec0f9ea3177fdfccfd", "sha256:13b0a721eee814f3a2fc4cbac3127011408fcbf03c3a8b2821b83cdf884692f5", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:f9fc4f0e6e78aa7308665f032c24481b4a7d800a774c7f5134f7bd2b61b9bdc6" ], "source_surface": { "node_kind": "resource", "node_id": "request-limits" }, "locators": [ { "artifact_digest": "sha256:029d1b51e3e3e9e706b97fb99b10ba4f44eaf497afc521ec0f9ea3177fdfccfd", "start_byte": 5443, "end_byte": 6253, "value_digest": "sha256:251be9db267d8aa4ab3e76c7b093d0aaceb6c8718c9f3fcfb3d09ae5a15e2e11" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5d8cf4b98ee682dd8f5a17dbc37e3d6bde3479088d3e65afdcb823250d73074b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:b7055b5b988d40076ab8fa2b03d119e5511ee86b1618bce705b929d2c02ce92f", "sha256:c3a11795116657dec360c3b8e8a35ac89d7f68e312e154d851720f6eefe4b759", "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "start_byte": 7578, "end_byte": 8379, "value_digest": "sha256:7e2af297c76aafe93ad83fb68706e857734ec10f8c0c372f5a78a47556060edd" } ] } ], "note": "Notion documents stable operation contracts across its API endpoints, including input parameters, JSON request bodies, HTTP headers, response schemas, async task handling, rate limits, and error status codes." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:00.874Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "content-api" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5d8cf4b98ee682dd8f5a17dbc37e3d6bde3479088d3e65afdcb823250d73074b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5c2622a9113f01bd9966273e91d8ded664b7d932f217f9a72f4c8326adece198", "sha256:c3a11795116657dec360c3b8e8a35ac89d7f68e312e154d851720f6eefe4b759", "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:cff2361340ba35a6fc2ae97fed35a30af4b212fffd67be88496a6f02804e1309", "start_byte": 8380, "end_byte": 9175, "value_digest": "sha256:45d5739ced8ebb33f2b18ffc4e66e3450ef9070ff2557c05ef575bd9525a0a8a" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:7c332c9cfb9a9cc24136d72d0ca6afbf59195c093713e7af51afa13c97e45e44", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9d2b937244f7f324288c2432195a209b895bc8dd777e0b6b4db6f0033c5c775f", "sha256:edbc75b9a7a8608af2d8b4953060defdf279c722ad44f9d7bbdbb4668d94f311" ], "source_surface": { "node_kind": "resource", "node_id": "api-overview" }, "locators": [ { "artifact_digest": "sha256:12bd751becd190be0f3aab4d9c300e149dc520c4f4348ab898154d82ce672207", "start_byte": 6081, "end_byte": 6882, "value_digest": "sha256:6dda9777a5bb0bb2a6d48080faf866ef0c582bee2034ad11bf6ca5ef1fac0de3" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1a9aa76d948b953a348c64782503ba2bd99795652ca76ace22799287c924a320", "capture_rung": "http" } ], "artifact_digests": [ "sha256:029d1b51e3e3e9e706b97fb99b10ba4f44eaf497afc521ec0f9ea3177fdfccfd", "sha256:4b84a2664f37eead9bc30f77fa1d043dad83a815ef9d8abeeea1cce6d89549c3", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:f9fc4f0e6e78aa7308665f032c24481b4a7d800a774c7f5134f7bd2b61b9bdc6" ], "source_surface": { "node_kind": "resource", "node_id": "request-limits" }, "locators": [ { "artifact_digest": "sha256:029d1b51e3e3e9e706b97fb99b10ba4f44eaf497afc521ec0f9ea3177fdfccfd", "start_byte": 7059, "end_byte": 7782, "value_digest": "sha256:df4b5d03a169d67b92fe08c334b16d18c5f95b8686334d7541c00a0d9cd568fc" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:670f0b3f02f84ac6b2f7ec2b20f45fcb7ed77fa36d9dd333a0a3cdfbb1214084", "capture_rung": "http" } ], "artifact_digests": [ "sha256:16bdf37a3555753df9225fc13961d10b00343fbc8d640a383a70365a9abcc7aa", "sha256:462d00961786b365df4b0b76cce2361203abd2d5a933c216ebe062628d8d4f1a", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:d437da14c781e94b76199d39210c39aec142a6d6827485d4bd45f3e739d98b66" ], "source_surface": { "node_kind": "resource", "node_id": "create-page" }, "locators": [ { "artifact_digest": "sha256:d437da14c781e94b76199d39210c39aec142a6d6827485d4bd45f3e739d98b66", "start_byte": 5582, "end_byte": 5963, "value_digest": "sha256:69c2849d8530f21b4bf1a1bc81d7ce89f1983207478f0e60b78bd868d46a0bd9" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b4e6e70cac193964540736daa3e6aba322e7bfac9abb7134defb57c68f616277", "capture_rung": "http" } ], "artifact_digests": [ "sha256:26dfaae4828c88b494085ac5dcf0ae37f118d44ac6689070373224c3eeb2e597", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:c9677aebe619cc1e2f87a85ef55ff25d266ed0ad12783da9625292cffb06ecaa", "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62" ], "source_surface": { "node_kind": "resource", "node_id": "status-codes" }, "locators": [ { "artifact_digest": "sha256:e5b3161cd01f5296742f3d8c2e5bc281d5e39311f37092b0bdd46221435c6b62", "start_byte": 4510, "end_byte": 5295, "value_digest": "sha256:582af856834b3d119cfc9258719b2fade8d391d76d51e2ba002f8bdf45c1a717" } ] } ], "note": "Every assessed target is accessible via a usable machine-operable interface, including the Notion REST API and the official JavaScript SDK (@notionhq/client)." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 16, "covered_signals": 16, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-08-20T15:57:00.874Z", "freshness": "fresh", "provenance": { "tier": "observed", "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "freshness_policy_digest": "sha256:00f7f2a35f37b184e57ce2cc116f6a5e3feb4813991aacd7e29e322f2d3607a8", "basis_event_ids": [ "sha256:14ded6d4cb167a75b1da4139e89bd1d93ed1e11f1d40a0670a1e856b148a4796", "sha256:152553e2c6b865bb1d9ef3ebe449024738d9ea88d87e11d77b4c0a7c8434ad5e", "sha256:189ce31784c16bcbd06780091601799517fdd9eacb990ccddbe1e3f82382a651", "sha256:1acc23df4ced4a167ca01a076fc2f7566b54d40a45773745eef1f4413c2bfbf4", "sha256:1ce77c0ae7530adf76615753e34ac723b4027d5325379c364b04d73c59f5380f", "sha256:246d56e40b6b5d460f47d1db48c75035e532210dde93df1e115a5f6e561f1f4c", "sha256:2cd6e217d41420f3ac4a60576afe7758c1134e04cf397dc16e8e5684a2520c70", "sha256:32394d94c48f68265bbfc899bb48d8fd2f20a884b9935dd88626e096a5e888d7", "sha256:323e61cd6a09275cc48562ddbce36fd445ac06eb1ac3b1aebe1db315077f6514", "sha256:3e27a3e8a1de0f8dbfcfc49246582a018a67440b38ea0862883c8e94e55bb8be", "sha256:45b826cc905dcf5eda2be8e36cfd39ac3ca4a2045ea93f1de5690f94e9ae6ef1", "sha256:49c631fad9d7b71e57d51f4f443058c3bee8b9fc30a06a18bcca4a0ecfad230a", "sha256:61d51824596787c20ae37f6e5015466122b661ddedc0008c3b0cd2bf759878d6", "sha256:635906012735b331a837c4e37782450c7025a50bdd634bc82ca02d326b15ac90", "sha256:72065eb74665dca3c2e0fbf41e83d32ccc09b40a3f55227101b2d8af27005397", "sha256:79d06fff1b49f46846da7d345c6162b99e00128f7ee72c0fedba2819a6e53422", "sha256:7daa1488729602837ca800ba496c45931eadacc14b1e23d616f7eaa0451b4074", "sha256:83e8e29cc308680d45f715864f27b25294d632606b2a44f1cc81350d8f26ccc7", "sha256:84eb9c5b198b243ed58f512afdb098a5a1fd9f51a34754029c15183e32f12dbc", "sha256:93b048d29d6b89e7b2aa4df741d02b0179adedee39e52da6ef9ea20431a77f77", "sha256:982d7b9d8971c19930245553f2acf7346320eb0d8cd9541a450805ab5ff46805", "sha256:b06a6a40ef67e38f8ac5b2f8e461843ffe91d40379f20563ec31bd612474a2a7", "sha256:b1650e3f610b5ee383c814549279d2278c57d71b0f686f3e1259a20009c2e46d", "sha256:b16fc3c06e08fd41236c8acf3e07d94cba74af65c9f43b3a18e7bc1b68cb8a47", "sha256:b9c428efd8aacb04534114f62a6bd768d9df241a47134d0ebe88f8ec5a8ed7aa", "sha256:ba5e0318787314e4a2d66344aa5261db7d45b2016ef08580866c1d205c4815e8", "sha256:d617cd13ab2d392546517816258e580fd7e0307f599a26a03515167ee99ae706", "sha256:d796726c4ca4853033053a7fdefad3fb748055f0174fce466bf29ae0f7367c98", "sha256:debbaf066d3a9672ab60afa29b65cc249860ceab2698c5c54d579d17d15fff7e", "sha256:ebc68dd417b85ee60f9372abfcffe983e2f40e366fa146d72ea0ab6f68f1c1cc" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:635906012735b331a837c4e37782450c7025a50bdd634bc82ca02d326b15ac90" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:18.693Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:d796726c4ca4853033053a7fdefad3fb748055f0174fce466bf29ae0f7367c98" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:15.284Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:152553e2c6b865bb1d9ef3ebe449024738d9ea88d87e11d77b4c0a7c8434ad5e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:18.693Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:7daa1488729602837ca800ba496c45931eadacc14b1e23d616f7eaa0451b4074" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:35.064Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:d617cd13ab2d392546517816258e580fd7e0307f599a26a03515167ee99ae706" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:48.263Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:ba5e0318787314e4a2d66344aa5261db7d45b2016ef08580866c1d205c4815e8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:48.263Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:45b826cc905dcf5eda2be8e36cfd39ac3ca4a2045ea93f1de5690f94e9ae6ef1", "sha256:61d51824596787c20ae37f6e5015466122b661ddedc0008c3b0cd2bf759878d6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:48.263Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:3e27a3e8a1de0f8dbfcfc49246582a018a67440b38ea0862883c8e94e55bb8be" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:18.677Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:189ce31784c16bcbd06780091601799517fdd9eacb990ccddbe1e3f82382a651" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:48.263Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:93b048d29d6b89e7b2aa4df741d02b0179adedee39e52da6ef9ea20431a77f77" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:35.064Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:14ded6d4cb167a75b1da4139e89bd1d93ed1e11f1d40a0670a1e856b148a4796" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:15.284Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:32394d94c48f68265bbfc899bb48d8fd2f20a884b9935dd88626e096a5e888d7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:35.064Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:2cd6e217d41420f3ac4a60576afe7758c1134e04cf397dc16e8e5684a2520c70" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:35.064Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:83e8e29cc308680d45f715864f27b25294d632606b2a44f1cc81350d8f26ccc7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:18.677Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:982d7b9d8971c19930245553f2acf7346320eb0d8cd9541a450805ab5ff46805" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:00.549Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:49c631fad9d7b71e57d51f4f443058c3bee8b9fc30a06a18bcca4a0ecfad230a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:00.549Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:b16fc3c06e08fd41236c8acf3e07d94cba74af65c9f43b3a18e7bc1b68cb8a47" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:18.677Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:246d56e40b6b5d460f47d1db48c75035e532210dde93df1e115a5f6e561f1f4c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:30.482Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:ebc68dd417b85ee60f9372abfcffe983e2f40e366fa146d72ea0ab6f68f1c1cc" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:18.677Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:1acc23df4ced4a167ca01a076fc2f7566b54d40a45773745eef1f4413c2bfbf4", "sha256:323e61cd6a09275cc48562ddbce36fd445ac06eb1ac3b1aebe1db315077f6514", "sha256:84eb9c5b198b243ed58f512afdb098a5a1fd9f51a34754029c15183e32f12dbc", "sha256:b1650e3f610b5ee383c814549279d2278c57d71b0f686f3e1259a20009c2e46d", "sha256:b9c428efd8aacb04534114f62a6bd768d9df241a47134d0ebe88f8ec5a8ed7aa" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:00.874Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:1ce77c0ae7530adf76615753e34ac723b4027d5325379c364b04d73c59f5380f", "sha256:72065eb74665dca3c2e0fbf41e83d32ccc09b40a3f55227101b2d8af27005397", "sha256:79d06fff1b49f46846da7d345c6162b99e00128f7ee72c0fedba2819a6e53422", "sha256:b06a6a40ef67e38f8ac5b2f8e461843ffe91d40379f20563ec31bd612474a2a7", "sha256:debbaf066d3a9672ab60afa29b65cc249860ceab2698c5c54d579d17d15fff7e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:00.874Z", "freshness": "fresh" } ] }, "canonical_url": "https://sourcey.com/catalog/notion/agent-readiness/notion-api/api-integration-lifecycle", "projection_digest": "sha256:26dfec6c51d147a6a12334facc765611fd447c9d09ef1ff1d84f26ebf0cab692" } } }