Reference · built on requestConnectorIdentity, IT & observability

1Password

Sign-in attempts, item usage, and audit events from a 1Password Business account through the Events API.

Request accessPricing ↗

About

1Password is a password manager run as a shared account for a company. A 1Password Business account holds vaults, items, users, groups and devices, and its Events API reports what happens to them: sign-in attempts, item usage in shared vaults, and audit events such as vault, group and user changes. The API is built for SIEM feeds and returns the last 120 days of activity.

Through Fibric, an operator pages the three event streams by cursor, joins them to your directory and offboarding records, and raises what needs a person: a failed sign-in run from a new location, or a shared credential read after its owner left.

This is a reference listing. It documents what Fibric would read from 1Password and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Sign-in attempts with when and where a user signed in, plus detail on failed attempts, through POST /api/v2/signinattempts
  • Item usage in shared vaults, including fill, reveal, secure-copy, export, share and server-fetch actions, through POST /api/v2/itemusages
  • Audit events for vaults, groups, users, invites, devices, service accounts and SSO settings through POST /api/v2/auditevents
  • Actor, action, object type, session login time, device UUID, IP address and geolocation on each audit event
  • The event features a bearer token may read, through GET /api/v2/auth/introspect
  • A cursor and has_more flag on every response, so reads resume from the last checkpoint

Proposed actions

Read-only. Actions need a separate connector.

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Confirm a departed user is really gone

    After an offboarding date, check audit events for the user's group and vault access removals and watch for any later sign-in attempt under that account.

    With Offboarding Sweep

  • Flag a sign-in run from an unfamiliar place

    Read sign-in attempts with their location and failure detail, compare against where the user normally signs in, and raise the outliers for a person to review.

    With Access Anomaly

  • Know which shared credentials were touched before rotating

    Pull item usage for a shared vault, list who filled, revealed, copied or exported each item and when, and attach that record to the rotation task.

    With Secret Rotation

  • Find accounts that never sign in

    Compare the roster against 120 days of sign-in attempts and propose a review of accounts with no recorded sign-in.

    With Stale Accounts

Requirements

  • A 1Password Business account
  • An owner or administrator to add the Events Reporting integration under Integrations > Directory
  • A token that includes the signinattempts, itemusages and auditevents features you want read; the default is all three
  • Client apps on 1Password 8.4.0 or later for item usage to be captured
Authentication
A bearer token issued by an Events Reporting integration in your 1Password Business account, sent as Authorization: Bearer and scoped to sign-in attempts, item usages and audit events.

Limits

  • The API returns data from the last 120 days only
  • Item usage is sent when a client app syncs, so actions can arrive late
  • object_details and aux_details are returned only when the object of the action is a team member
  • No documented endpoint creates, edits or removes items, users or vaults

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request 1Password ↗

Questions and answers

Can the connector change anything in 1Password?
No. The Events API documents GET /api/v2/auth/introspect and three POST endpoints that page through events. None creates, edits or deletes items, users or vaults. Item usage events describe how and when an item in a shared vault was used.
How far back can the connector read?
120 days. The first request sends a ResetCursor with a start_time, an optional end_time and a limit. Every response carries a cursor and has_more, and later requests send that cursor to continue from where the last read stopped.
Which 1Password plan and role are needed?
A 1Password Business account. An owner or administrator adds an Events Reporting integration under Integrations > Directory and issues a bearer token. Expiry can be 30, 90 or 180 days; the default is never. The token can be limited to sign-in attempts, item usages or audit events.
Ask about 1Password

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with 1Password through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy