Customer setup guide

Review full workspace membership in Notion.

Create a workspace-owned internal integration, submit its secret in the Sythe Labs platform, and let the platform collect full workspace members for periodic access reviews. Notion excludes guests from this roster. The integration is granted no content capabilities, so it can never read a page, a database, or a comment.

Open signed-in Integrations Read Notion authorization documentation

Connection availability

The signed-in Sythe Labs platform Integrations page is the source of truth for connection access. This public page documents customer setup and does not announce availability.

Overview

Two GET requests. No content access.

The Sythe Labs platform reads one Notion workspace's full-member roster and nothing else. Guests are not included in GET /v1/users. The platform maintains the workspace as an approved subprocessor in your asset inventory and supplies the returned roster to periodic access review campaigns. It does not issue requests that create, mutate, or delete anything in Notion.

Read pathGET requests only

Identify the integration

Confirm the secret is usable and record the workspace it is bound to. This is the check that rejects a user-owned token.

GET /v1/users/me

List full workspace members

Collect full workspace members and integration bots, following cursor pagination until the returned roster is complete. Guests are not included in GET /v1/users.

GET /v1/users

Before you start

The integration must belong to the workspace, not to you.

The customer creates and controls the credential. Do not send a Notion integration secret to Sythe Labs staff, paste it into a support request, or ask staff to enter your Notion workspace.

01
A Notion workspace owner for the workspace you intend to connect. Only an owner can create a workspace-owned internal integration.
02
One Notion workspace selected for this connection.
03
Organization administrator access to the signed-in Sythe Labs platform Integrations page.

Create the integration

Internal, workspace-owned, user capability with email.

Both settings below are required. The Sythe Labs platform rejects the connection if either is missing, and stores nothing when it does.

A user-owned integration understates the roster

An integration owned by a single user only ever sees the person who granted it, so its member list would look complete while missing almost everyone. Preflight rejects that case rather than recording a roster that would silently pass an access review.

Request this	Where	Why
Internal integration	notion.so/profile/integrations -> New integration -> Internal	A workspace-owned internal integration can list full workspace members. Notion excludes guests from /v1/users.
Capability "Read user information, including email addresses"	Integration -> Capabilities -> User capabilities	Without it Notion returns 403 on /v1/users; without emails the roster cannot be matched to personnel.

01
Open notion.so/profile/integrations while signed in to the workspace you intend to connect.
02
Choose New integration and set Type to Internal.
03
Set Associated workspace to the workspace whose full members you want reviewed.
04
Under Capabilities, User capabilities, select "Read user information, including email addresses".
05
Leave content capabilities unselected. The Sythe Labs platform never reads pages or databases.
06
Copy the Internal Integration Secret directly into your password manager.

Open Notion integrations

Connect in the Sythe Labs platform

Enter the Internal Integration Secret.

01
Open the signed-in Sythe Labs platform Integrations page and open the Notion connection form.
02
Enter the Internal Integration Secret. The form does not ask for a workspace ID.
03
Select Connect. Preflight confirms the integration is workspace-owned and can read full-member email addresses.
04
The first sync records the workspace as an approved subprocessor and collects the full-member roster. Notion excludes guests from this API roster.

Connection stays unchanged after failed validation

A rejected secret is not stored, does not remove inventory, and does not mark a sync successful. Correct the reported reason and submit again.

Access and data

Full workspace members, and nothing from your pages.

Workspace

The connected Notion workspace becomes one approved SaaS service in your asset inventory, and that entry is its subprocessor record.

Full workspace members

Every full workspace member returned by /v1/users, with the name and email address Notion reports. Guests are not included.

Integration bots

Counted for the inventory record, but excluded from access reviews. A bot is a workspace automation, not a person whose access a reviewer can revoke.

Excluded

Guests, pages, databases, blocks, comments, file attachments, and every other content surface. Notion excludes guests from /v1/users, and the integration is not granted content capabilities.

What it proves

Membership, not privilege.

Notion's public API reports each full workspace member's identity but no role, permission level, group membership, or last-active timestamp. Guests are not included in GET /v1/users. Role data exists only on Notion's SCIM API, which requires an Enterprise plan and a separate credential.

Privilege is reported as unknown, never as none

A reviewer sees that a returned full member has workspace access. The platform does not claim a member is unprivileged, because the API gives it no basis to. Use Notion's own settings when an auditor needs guest coverage. Use a SCIM-backed export when an auditor needs member-role coverage.

Periodic access review: the full-member roster becomes a reviewable population, one decision per returned member. Guests are excluded.
Asset inventory: the workspace is recorded as one approved SaaS service with its full-member counts.
Subprocessor register: connecting the workspace records Notion as a vendor authorized to process your data.

Secret lifecycle

The customer controls rotation and revocation.

The Sythe Labs platform stores the secret encrypted and uses it only for the two GET operations in this guide. Notion remains the source of truth for integration status.

Replace

Create a new internal integration secret in the same Notion workspace and replace it in the Sythe Labs platform. Replacement preflight re-confirms workspace ownership and the user capability, and rejects a secret from a different workspace.

Rotate

Rotate the secret in Notion, then replace it in the Sythe Labs platform. Notion invalidates the previous secret the moment you rotate, so replace promptly to avoid a failed scheduled sync.

Revoke

Delete the integration in Notion when access must stop immediately. The Sythe Labs platform never deletes or rotates a Notion integration on your behalf.

Disconnect

Disconnect in the Sythe Labs platform to delete the encrypted secret, remove the Notion workspace from Cloud Services, and stop scheduled syncs. Access reviews already collected keep the full-member snapshot they were drawn from.

Troubleshooting

Resolve a reported stable reason.

A failed connection or secret replacement reports a stable reason, a guide link, and a request identifier. Match the reported reason to the action below. An asynchronous sync status retains only its safe failure message. Never copy the integration secret into a message.

The internal integration secret is not usable

notion_invalid_key

Open notion.so/profile/integrations, select the integration, and copy its Internal Integration Secret again. Notion regenerates the secret when you rotate it, so an older copy stops working immediately.

The token is owned by a single user, not the workspace

notion_not_workspace_owned

A user-owned integration only ever sees the person who granted it, so its full-member roster would silently understate the supported population. Create an internal integration owned by the workspace instead.

1Open notion.so/profile/integrations and choose New integration.
2Set Type to Internal and Associated workspace to the workspace you intend to review.
3Copy the Internal Integration Secret and submit it in the Sythe Labs platform.

The integration cannot read user information

notion_user_capability_missing

Notion answers /v1/users with 403 until the user capability is granted. Open the integration, then Capabilities, then User capabilities, and choose the option that includes email addresses. Save, then retry.

The integration reads names but not email addresses

notion_email_capability_missing

Notion has two user capabilities. The narrower one returns every full workspace member with an empty person object, which cannot be matched to your personnel roster. Select "Read user information, including email addresses" and retry.

Notion returned no full workspace members

notion_workspace_no_members

Notion returned the /v1/users roster successfully but listed no full workspace member accounts, so this connector has no supported access-review subjects. Guests are not included in this endpoint, so this result does not mean the workspace is empty.

1Open notion.so/profile/integrations, select the integration, and check Associated workspace.
2If that names the wrong workspace, create the integration inside the workspace whose full members you intend to review and submit its secret instead.
3If it names the right workspace, confirm the workspace has at least one full member, not only guests, and retry.

The replacement secret belongs to a different workspace

notion_workspace_mismatch

Create the replacement inside the workspace that is already connected. Disconnect first only when you intend to bind a different Notion workspace, which discards the existing inventory row.

Notion is temporarily unavailable

notion_upstream_unavailable

Retry after Notion service recovers. The existing connection, inventory, and any access review already collected remain unchanged after an incomplete sync. A sustained rate limit reports the same reason; the daily scheduled sync retries on its own.

Notion returned an unsupported result

notion_unexpected_response

Notion returned a response the Sythe Labs platform could not safely interpret. This does not by itself mean the secret is invalid.

1Retry once from the signed-in Integrations page with the same secret.
2Wait for a pending Sythe Labs platform update before trying again. Do not broaden the integration's capabilities to resolve an unsupported response.
3If it repeats, send the stable reason and platform request ID to Sythe Labs support. Do not include the integration secret.

Notion returned more user rows than one snapshot can carry

notion_workspace_too_large

The connector refuses above 20,000 returned user rows rather than truncating an access-review population. This cap counts every row Notion returns, including integration bots and duplicates. Contact Sythe Labs support so the roster can be collected safely.

Need platform help?

Use the Sythe Labs support page and include the stable reason code and any safe request identifier shown in the Sythe Labs platform. For an asynchronous sync status, include only the safe failure message shown there. Do not include the integration secret.