# Notion: 4 point Door Gap
- Site: notion.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/notion-3htdjb
- Scanner version: 12
Notion publishes prices and API specs but gates API key provisioning behind account verification and a sales process for enterprise features.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 68/100 |
| Agents | 64/100 |
| Composite | 66/100 |
| Door Gap | 4 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 11 of 15 requests, but could not find a contact route for machines. It came up empty on 3 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- ok      find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- missing read the homepage as data rather than as a page
- ok      find a machine readable API spec
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **robots.txt blocks 1 AI crawler, so those assistants cannot read this site at all.** (machine_discoverability)
2. **No security.txt file is published, leaving no trusted channel for agents or researchers to report vulnerabilities or verify API legitimacy.** (machine_fetchable_trust)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/notion-3htdjb
## Files generated from this scan
- **Pricing as Offer structured data** at `pricing page`, 20 minutes, developer. Verify: The next scan reads Offer structured data with a price and currency on the pricing page, and the pricing check credits it.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/notion-3htdjb
## The agent door
- **machine_discoverability** 70/100. Robots.txt blocks one training crawler (meta-externalagent) while allowing major AI crawlers including GPT, Claude, Gemini and Perplexity. A real browser is served normally.
- **programmatic_onboarding** 50/100. An OpenAPI spec is published at developers.notion.com/openapi.json with documentation, enabling client generation. However, neither OAuth authorization metadata nor pricing.md is published at standard paths.
- **pricing_legibility** 85/100. 10 prices are readable without JavaScript on the pricing page in USD per seat: Free, Plus at $10, Team at $20, and Enterprise routed to sales. This is standard practice and not a defect.
- **agent_aware_instrumentation** 73/100. An MCP manifest is published at /.well-known/mcp.json. The OpenAPI spec is machine readable. Robots.txt blocks one training crawler (meta-externalagent) while allowing search and agent crawlers.
- **machine_fetchable_trust** 40/100. No security.txt is published at /.well-known/security.txt. The homepage responds to automated requests with HTTP 200. Without a security contact or vulnerability disclosure policy, an agent cannot verify the legitimacy of the API or report.
- **commercial_rails** 65/100. Prices are published in raw HTML on the pricing page. A self serve signup form is 2 steps from the homepage with no required fields and no payment gate.
## The human door
- **steps_to_first_value** 80/100. The primary call to action 'Get Notion free' reaches a signup form in 2 steps from the homepage. The form has 2 fields with 0 required, so a visitor can enter minimal information.
- **required_fields** 90/100. The signup form has 2 fields and 0 are marked required. A visitor can proceed with minimal data entry. This removes friction for both human and agent evaluation.
- **verification_walls** 65/100. The signup page itself has no verification requirement visible. However, the scan did not walk past form submission to observe whether email verification is enforced before account access. The form is accessible without barriers.
- **error_recovery** 35/100. 0 of 2 inputs on the signup form carry validation rules or descriptions. An agent or human entering invalid data receives no inline feedback or guidance on what is expected, making error recovery difficult without trial and error.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp