Notion
Authentication & Authorization
Credentials
-
Notion connects via OAuth 2.0 with Authorization Code Flow.
-
Client ID and Client Secret credentials can be obtained during the setup of the Notion Public Integration (see Notion Connection Instructions).
-
The Access Token received during the authorization process does not expire and the Notion authorization API doesn't use token renewal.
-
Publicly exposing your API credentials can allow unauthorized access to the Notion API endpoints, and your Notion data by a third party. DataGrail stores your API credentials encrypted and protected.
Permissions
At the setup stage, the Notion Public Integration must be granted the following permissions (capabilities) in order to allow DataGrail read on certain objects necessary to complete data access:
- Read content
- Read user information including email addresses
Endpoints Utilized
-
Request authorization:
GET https://api.notion.com/v1/oauth/authorize
-
Get access token:
POST https://api.notion.com/v1/oauth/token
-
Validate that credentials are good based on a successful response:
GET https://api.notion.com/v1/users
Version
DataGrail Notion integration currently supports REST API version 1.
Limits
- DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
- DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).
Access
For an access request, DataGrail will take the following actions:
- Search users by the data subject email address,
- Search databases and select those that have fields of email and rich_text types,
- Query each of the selected databases for records containing data subject email,
- Filter false positives (erroneous findings), if any.
Endpoints Utilized
GET https://api.notion.com/v1/usersPOST https://api.notion.com/v1/searchPOST https://api.notion.com/v1/databases/{database_id}/query
Deletion
DataGrail supports only the Direct Contact Deletion workflow for Notion.
Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.