> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Notion

## After this article

You will be able to connect Notion to Lumos to sync Notion workspace members and deprovision users during offboarding, Access Reviews, and license management.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | Workspace members, read via SCIM |
| Deprovision User | Offboarding | N/A | Yes | Removes the user from the workspace and logs out all sessions |

Account status mapping: Notion `active` maps to Active, `inactive` maps to Suspended, and a deleted user (one Notion no longer returns) maps to Suspended.

**Deprovisioning behavior:** deprovisioning marks the account **Suspended** in Lumos, removes the user from your Notion workspace, logs them out of all active sessions, and reclaims a license. Notion accounts can't be fully deleted through SCIM, so full deletion must be done manually in Notion.

**Roles and groups are not synced as entitlements.** Account-level Access Reviews (who has a Notion account) work natively. For a by-role or privileged-Access Review, bring workspace roles in via CSV: export members and their roles from Notion, build a CSV with an Email column and a Roles column, and upload it on the Notion app in Lumos via **Add custom data**, mapping the role column as a **Permission Field** (not an Attribute Field).

## Required plan and roles

* **Notion plan:** SCIM provisioning requires the Notion **Enterprise** plan.
* **Notion role:** the connecting user must be at least a **Workspace Owner**.
* **Credential:** a Notion **SCIM API token**.
* **Permission scoping:** the SCIM token grants both read (list users) and write (remove users). The connector is identity-only by design. It syncs users and can deprovision them, but it doesn't sync roles or group memberships as entitlements.

## Read-only access vs provisioning

**Is read-only possible?** No. The SCIM API token this connector uses grants both read (list users) and write (remove users) in a single combined scope, and no narrower, read-only credential is documented for this connector.

**What full provisioning requires.** A Notion Enterprise plan, a connecting user who is at least a Workspace Owner, and a SCIM API token generated for the workspace. Follow the steps below to generate the token and enter it in Lumos.

**Watch out for.** "Provisioning" here means deprovisioning only, removing a user from the workspace and logging them out, not creating accounts or syncing roles and group memberships. Roles and groups aren't synced as entitlements at all, so a role-based Access Review needs workspace roles brought in separately through a CSV upload.

## Instructions

**Phase 1: Generate a SCIM API token in Notion**

1. Log in to Notion as a Workspace Owner on an Enterprise-plan workspace.
   1. Please follow the instructions in this[ Notion Help Document](https://www.notion.com/help/provision-users-and-groups-with-scim) to enable SCIM on your account.
   2. Generate a SCIM bearer and store it for alter.
2. Generate a SCIM API token for your workspace and copy it.

**Phase 2: Connect in Lumos**

1. Find the Notion card in your Lumos integrations (reconnect an existing card or add a new one).
2. Choose a unique identifier for the integration (e.g. `notion-1`) and enter it in the **App Instance Identifier** field.
3. Enter the SCIM API token in the **API Key** field.
4. Click **Connect Notion**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**User sync is healthy but entitlement count is zero.** This is expected, not a sync failure. The connector is identity-only and doesn't sync roles or groups. Native role syncing would be a feature request.

**CSV-uploaded roles create duplicate entitlements.** Keep the CSV header casing consistent across uploads. A casing change creates duplicate entitlements. Each upload is a full snapshot, so rows omitted from a new upload are marked removed. CSV-sourced roles are manually maintained and must be re-uploaded to refresh.

**A deprovisioned user's Notion account still exists.** This is expected. SCIM removes the user from the workspace but can't fully delete the Notion account. Delete the account manually in Notion if required.