Some cookies are necessary for SecondDoor to work. Others are optional, and tell us how the site and the product are used. Accept all, or decline all optional ones. Without a selection, nothing optional is set. More in our cookie policy.
Basic scanSoftware business · Marketing site/Scanned 8 Sept 2026, 13:45 UTC/1 browser pass
Notion publishes prices and API specs but gates API key provisioning behind account verification and a sales process for enterprise features.
Older scan
This report was produced by an earlier version of the scanner. Some findings may not match how the site is measured now.
Narrow. Both audiences hit roughly the same walls.
Ordered by what the evidence says is costing most. Written for whoever owns the site, not whoever builds it.
1 piece of evidence and the recommended fix are recorded for this issue.
This is a basic scan, so it raises the three issues the deterministic evidence supports. A deep scan sends two agents over the site and raises up to ten, each with cited evidence and the screens to prove it.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
The score and the audit trail stay public. The evidence and the files open with an account.
The audit trail behind every number above. Not measured is not zero.
Machine discoverability
Robots.txt blocks one training crawler (meta-externalagent) while allowing major AI crawlers including GPT, Claude, Gemini and Perplexity. A real browser is served normally.
4 observations recorded.
Programmatic onboarding
An OpenAPI spec is published at developers.notion.com/openapi.json with documentation, enabling client generation. However, neither OAuth authorization metadata nor pricing.md is published at standard paths.
3 observations recorded.
Pricing legibility
10 prices are readable without JavaScript on the pricing page in USD per seat: Free, Plus at $10, Team at $20, and Enterprise routed to sales. This is standard practice and not a defect.
1 observation recorded.
Agent-aware instrumentation
An MCP manifest is published at /.well-known/mcp.json. The OpenAPI spec is machine readable. Robots.txt blocks one training crawler (meta-externalagent) while allowing search and agent crawlers.
4 observations recorded.
Machine-fetchable trust
No security.txt is published at /.well-known/security.txt. The homepage responds to automated requests with HTTP 200. Without a security contact or vulnerability disclosure policy, an agent cannot verify the legitimacy of the API or report.
2 observations recorded.
Commercial rails
Prices are published in raw HTML on the pricing page. A self serve signup form is 2 steps from the homepage with no required fields and no payment gate.
2 observations recorded.
Steps to first value
The primary call to action 'Get Notion free' reaches a signup form in 2 steps from the homepage. The form has 2 fields with 0 required, so a visitor can enter minimal information.
1 observation recorded.
Required fields
The signup form has 2 fields and 0 are marked required. A visitor can proceed with minimal data entry. This removes friction for both human and agent evaluation.
1 observation recorded.
Verification walls
The signup page itself has no verification requirement visible. However, the scan did not walk past form submission to observe whether email verification is enforced before account access. The form is accessible without barriers.
1 observation recorded.
Error recovery
0 of 2 inputs on the signup form carry validation rules or descriptions. An agent or human entering invalid data receives no inline feedback or guidance on what is expected, making error recovery difficult without trial and error.
1 observation recorded.
It got through 11 of 15.
The agent got through 11 of 15 requests, but could not find a contact route for machines. It came up empty on 3 other checks too.