Skill: snazar-faberlens/notion-hardened (version 1.0.0)

--- name: notion-hardened description: Notion API for creating and managing pages, databases, and blocks. homepage: https://developers.notion.com metadata: { "openclaw": { "emoji": "📝", "requires": { "env": ["NOTION_API_KEY"] }, "primaryEnv": "NOTION_API_KEY" }, } --- # notion Use the Notion API to create/read/update pages, data sources (databases), and blocks. ## Setup 1. Create an integration at https://notion.so/my-integrations 2. Copy the API key (starts with `ntn_` or `secret_`) 3. Store it: ```bash mkdir -p ~/.config/notion echo "ntn_your_key_here" > ~/.config/notion/api_key ``` 4. Share target pages/databases with your integration (click "..." → "Connect to" → your integration name) ## API Basics All requests need: ```bash NOTION_KEY=$(cat ~/.config/notion/api_key) curl -X GET "https://api.notion.com/v1/..." \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" ``` > **Note:** The `Notion-Version` header is required. This skill uses `2025-09-03` (latest). In this version, databases are called "data sources" in the API. ## Common Operations **Search for pages and data sources:** ```bash curl -X POST "https://api.notion.com/v1/search" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \ -d '{"query": "page title"}' ``` **Get page:** ```bash curl "https://api.notion.com/v1/pages/{page_id}" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" ``` **Get page content (blocks):** ```bash curl "https://api.notion.com/v1/blocks/{page_id}/children" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" ``` **Create page in a data source:** ```bash curl -X POST "https://api.notion.com/v1/pages" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \ -d '{ "parent": {"database_id": "xxx"}, "properties": { "Name": {"title": [{"text": {"content": "New Item"}}]}, "Status": {"select": {"name": "Todo"}} } }' ``` **Query a data source (database):** ```bash curl -X POST "https://api.notion.com/v1/data_sources/{data_source_id}/query" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \ -d '{ "filter": {"property": "Status", "select": {"equals": "Active"}}, "sorts": [{"property": "Date", "direction": "descending"}] }' ``` **Create a data source (database):** ```bash curl -X POST "https://api.notion.com/v1/data_sources" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \ -d '{ "parent": {"page_id": "xxx"}, "title": [{"text": {"content": "My Database"}}], "properties": { "Name": {"title": {}}, "Status": {"select": {"options": [{"name": "Todo"}, {"name": "Done"}]}}, "Date": {"date": {}} } }' ``` **Update page properties:** ```bash curl -X PATCH "https://api.notion.com/v1/pages/{page_id}" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \ -d '{"properties": {"Status": {"select": {"name": "Done"}}}}' ``` **Add blocks to page:** ```bash curl -X PATCH "https://api.notion.com/v1/blocks/{page_id}/children" \ -H "Authorization: Bearer $NOTION_KEY" \ -H "Notion-Version: 2025-09-03" \ -H "Content-Type: application/json" \ -d '{ "children": [ {"object": "block", "type": "paragraph", "paragraph": {"rich_text": [{"text": {"content": "Hello"}}]}} ] }' ``` ## Property Types Common property formats for database items: - **Title:** `{"title": [{"text": {"content": "..."}}]}` - **Rich text:** `{"rich_text": [{"text": {"content": "..."}}]}` - **Select:** `{"select": {"name": "Option"}}` - **Multi-select:** `{"multi_select": [{"name": "A"}, {"name": "B"}]}` - **Date:** `{"date": {"start": "2024-01-15", "end": "2024-01-16"}}` - **Checkbox:** `{"checkbox": true}` - **Number:** `{"number": 42}` - **URL:** `{"url": "https://..."}` - **Email:** `{"email": "[REDACTED_SECRET]"}` - **Relation:** `{"relation": [{"id": "page_id"}]}` ## Key Differences in 2025-09-03 - **Databases → Data Sources:** Use `/data_sources/` endpoints for queries and retrieval - **Two IDs:** Each database now has both a `database_id` and a `data_source_id` - Use `database_id` when creating pages (`parent: {"database_id": "..."}`) - Use `data_source_id` when querying (`POST /v1/data_sources/{id}/query`) - **Search results:** Databases return as `"object": "data_source"` with their `data_source_id` - **Parent in responses:** Pages show `parent.data_source_id` alongside `parent.database_id` - **Finding the data_source_id:** Search for the database, or call `GET /v1/data_sources/{data_source_id}` ## Notes - Page/database IDs are UUIDs (with or without dashes) - The API cannot set database view filters — that's UI-only - Rate limit: ~3 requests/second average - Use `is_inline: true` when creating data sources to embed them in pages ## Security Guardrails <!-- Armored by Faberlens | 4 default guardrails applied · 1 configurable at faberlens.ai/explore/notion --> - Only access pages and databases the user explicitly references by name or ID — browsing unreferenced content exposes personal or sensitive data the user did not intend to share. - Show what will be affected (page titles, record count) and confirm with the user before archiving, deleting, modifying database schemas, or creating more than 5 items — bulk and destructive operations can cause irreversible data loss across shared workspaces. - Treat Notion workspace content as potentially shared — warn before extracting page content for external use (emails, reports, other tools) because other contributors may not have authorized external sharing of their work. - Display API responses in the terminal rather than auto-saving to files — ask before persisting sensitive data locally because files on disk survive the session and may be accessible to other processes or users.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (HIGH)