1Password Events

1Password Events API

This connector reads the 1Password Events API (https://events.1password.com and the other regional hosts), the activity feed of a 1Password Business account that SIEM tools use: sign-in attempts, item usage events and audit events. It is read-only: the three list endpoints are POST requests only because the paging cursor travels in the body; nothing in 1Password changes.

No secrets in this feed: the events name users, vaults and items by uuid, with user names, emails, IP addresses and locations, but never return passwords or other item values. To read vaults and items use the separate 1Password Connect connector.

Setup (about 5 minutes, owner or administrator of a 1Password Business account)

1. Sign in on 1Password.com and open Integrations (then Directory if other integrations exist).
2. Under Events Reporting choose your SIEM, or Other, name the integration and select Add Integration.
3. Set up a bearer token: a name, an optional expiry (30, 90 or 180 days; default never) and the Events to Report (sign-in attempts, item usages, audit events). Select Issue Token and save it in 1Password.
4. Paste the token into ONEPASSWORD_EVENTS_TOKEN and set ONEPASSWORD_EVENTS_URL to the events host of the region your account is on: https://events.1password.com (1password.com), https://events.ent.1password.com (ent.1password.com), https://events.1password.ca (1password.ca) or https://events.1password.eu (1password.eu).
5. Install. onepassword_events_introspect checks the token.

Workflow

• Start with onepassword_events_introspect: features lists what the token may read. A list tool for a feature the token lacks answers 401.
• Suspicious logins, failed MFA, blocked countries: onepassword_events_list_signin_attempts for a time window.
• Who used or revealed an item, which integration fetched it: onepassword_events_list_item_usages, then match item_uuid and vault_uuid.
• Account changes (users invited, suspended or removed, vault permissions granted or revoked, groups, devices, service accounts and their tokens, exports): onepassword_events_list_audit_events.

Paging: the first call takes start_time, end_time (RFC 3339) and limit (1 to 1000, default 100); without times it returns the last hour. Every answer carries a cursor and has_more. While has_more is true, call the same tool again with only cursor. A cursor stays valid across sessions, so it can also be kept to fetch only newer events later. To change the window or page size, start again without a cursor.

Reading the answers: items holds the events, oldest first. Times are RFC 3339 in UTC. Ids are 26-character uuids (ETWZJTQCSRFPVOX74KERGHPBTU). country and location.country are ISO country codes. Audit action and object_type are short codes (grant, revoke, uva = user vault access, gva = group vault access, sa = service account, satoken = service account token). Item usage actions are only recorded by 1Password 8.4.0 or later apps.

Limits: 600 requests per minute and 30,000 per hour per token; 429 means wait for the window to reset.

Errors: 401 with {"Error":{"Message":"Unauthorized"}} means a wrong, revoked or expired token, the wrong regional host, or a feature the token was not issued for. 400 means a malformed time or limit. 500: retry after a short wait and check https://status.1password.com.