canonical: https://jentic.com/apis/1password.com/1password # 1Password Events API Retrieve audit events, item usage logs, and sign-in attempt records from 1Password Business accounts through 5 focused endpoints. The Events API surfaces security-relevant activity including vault item access patterns, failed authentication attempts, and administrative changes across the organization. Regional endpoint support (US, Canada, EU) ensures data residency compliance while bearer token authentication via service account JWTs provides secure programmatic access for SIEM integrations and security monitoring workflows. ## For AI agents Retrieve 1Password audit events, item usage logs, and sign-in attempts to monitor vault access patterns, detect suspicious activity, and feed security events into SIEM systems. ## Scope Does not handle credential storage, vault item creation, or password generation - use for read-only security event monitoring and audit logging only. ## Capabilities - Stream audit events tracking administrative actions like vault creation, policy changes, and group modifications - Query item usage records showing which vault items were accessed, by whom, and from which client - Retrieve sign-in attempt logs with success/failure status, IP addresses, and MFA method details - Introspect bearer tokens to validate service account permissions and scopes - Filter events by timestamp cursors for incremental consumption without duplicates ## Use cases ### AI Agent Security Event Monitoring An AI agent uses the 1Password Events API through Jentic to monitor vault access patterns and detect anomalous activity. The agent queries item usage logs for unusual access times, checks sign-in attempts for failed authentication spikes, and retrieves audit events for unauthorized policy changes - all without manually configuring JWT service account tokens or determining regional endpoint URLs. Example prompt: Query POST /api/v1/signinattempts for failed sign-in attempts in the last 24 hours and identify any accounts with more than 5 failures ### SIEM Integration for Credential Access Feed 1Password event data into SIEM systems for centralized security monitoring and correlation with other security signals. The Events API provides paginated access to audit events, item usages, and sign-in attempts with cursor-based pagination for reliable incremental consumption. Security teams correlate credential access events with network activity, endpoint alerts, and identity provider logs to detect compromised accounts. Example prompt: Retrieve the latest audit events via POST /api/v1/auditevents with a cursor from the last sync, then process all new events and store the returned cursor for next iteration ### Insider Threat Detection Detect potential insider threats by analyzing vault item usage patterns for anomalous behavior. The item usages endpoint reveals which credentials and secrets are being accessed, by which user, from which device, and at what time. Security teams build baselines of normal access patterns and alert on deviations like after-hours access to sensitive vaults, bulk credential retrieval, or access from new geographic locations. Example prompt: Query POST /api/v1/itemusages for all item access events in the last 7 days, group by user and time-of-day to identify access outside normal business hours ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /api/v1/auditevents | Retrieve audit events with cursor-based pagination | | POST | /api/v1/itemusages | Query vault item usage records | | POST | /api/v1/signinattempts | List sign-in attempts with success/failure status | | POST | /api/auth/introspect | Introspect bearer token to validate permissions | | POST | /api/v2/auth/introspect | V2 token introspection with extended metadata | ## Key resources - **Audit Events** — Administrative action logs including vault creation, policy changes, and group modifications - **Item Usages** — Records of vault item access showing user, item, client, and timestamp - **Sign-in Attempts** — Authentication logs with success/failure, IP address, and MFA details - **Auth Introspection** — Token validation endpoints for verifying service account permissions ## Why Jentic - **Setup:** Wiring the 1Password Events API by hand means managing its service-account bearer token and choosing the correct regional host among the US, CA, EU, and Enterprise endpoints yourself. Through Jentic you install once, import the 1Password Events API from the API Directory, store the token once, and your agent calls it. - **Permission scoping:** The Events API selects records through request-body filters like cursors and date ranges rather than a resource id in the path, so limit the agent to the operations it needs, such as reading audit events or sign-in attempts, and leave out others unless you add them. You choose the allowed set, so only the operations you pick can run. - **Credential handling:** Your 1Password service-account token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'monitor vault item access' or 'pull recent sign-in attempts', and Jentic returns the matching 1Password Events operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Okta API** — Identity provider whose authentication events correlate with 1Password credential access patterns - **Duo Security API** — MFA platform whose auth logs correlate with 1Password sign-in attempt data - **Keeper Security API** — Competing enterprise password manager with similar vault and audit capabilities ## FAQ ### What authentication does the 1Password Events API use? The Events API uses bearer token authentication with JWT service account tokens. You generate a service account token in the 1Password Business admin console and supply it in the Authorization header as 'Bearer {token}'. Through Jentic, your JWT is stored encrypted in your Jentic One instance and agents receive scoped access without raw tokens entering context. ### Can I monitor which vault items were accessed with the Events API? Yes. Use POST /api/v1/itemusages to retrieve item usage records. Each record includes the user who accessed the item, the item name and vault, the client application used, and the timestamp. You can paginate through results using cursor-based pagination to process large datasets incrementally. ### What are the rate limits for the 1Password Events API? The 1Password Events API enforces rate limits per service account token. The API returns 429 status codes when limits are exceeded. Use cursor-based pagination to retrieve events incrementally rather than requesting the full history in a single call, which helps stay within rate limits. ### How do I detect failed sign-in attempts through Jentic? Search Jentic for 'detect failed authentication attempts', which returns the POST /api/v1/signinattempts operation. Query sign-in attempts filtered by timestamp, and check the success field to identify failures. Each record includes the IP address, country, and MFA method used. Install with pip install jentic and run it through Jentic One, the self-hosted execution layer. ### Which regional endpoints does the 1Password Events API support? The Events API supports three regional endpoints for data residency compliance: US (events.1password.com), Canada (events.1password.ca), and EU (events.1password.eu). Your service account token determines which region to use based on your 1Password Business account location. ### Can I use cursor-based pagination to avoid duplicate events? Yes. All three event endpoints (auditevents, itemusages, signinattempts) support cursor-based pagination. The response includes a cursor value that marks your position in the event stream. Store this cursor between requests and pass it in subsequent calls to retrieve only new events since your last query, ensuring no duplicates. ### Does the Events API provide real-time streaming? The Events API uses a polling model with cursor-based pagination rather than real-time streaming. Poll the endpoints at regular intervals (recommended 1-5 minutes) using your stored cursor to retrieve new events incrementally. This approach works well for SIEM integrations that process events in batches. ### Can I limit what my agent is allowed to do with the 1Password Events API? Yes. Because you run Jentic One self-hosted, your own rules decide which operations and credentials the agent may use. Since the Events API selects records through request-body filters like cursors and date ranges rather than a resource id in the path, you scope the agent to only the operations it needs, such as reading audit events, item usages, or sign-in attempts, and leave the token introspection endpoints out unless you add them. Only the operations you pick can run, and the service-account token is injected at execution time without entering the agent's context.