1Password Events Reporting item usage actions
You can use the 1Password Events API to send your 1Password account activity to your security information and event management (SIEM) system, including item usage.
ItemUsage objects contain actions, which describe how an item was used.
Actions are only captured from client apps using 1Password 8.4.0 or later.
Item usage activity is only sent when client apps sync to the 1Password server. Not all item usage triggers a sync, so there may be delays before actions are received.
Item usage action values
Possible values for action include:
enter-item-edit-modeexportfillotherrevealsecure-copy
select-sso-providerserver-createserver-fetchserver-updateshare
The behaviors that trigger each type of action are grouped below by 1Password client type.
enter-item-edit-mode
| Client | Behavior |
|---|---|
| 1Password apps | Add an item to Favorites. Edit an item. Usage is recorded upon selecting Edit, whether or not the item is modified. |
export
| Client | Behavior |
|---|---|
| 1Password apps | Download a file. Export 1Password account data as a 1PUX or CSV file. Usage is recorded for every exported item. |
fill
| Client | Behavior |
|---|---|
| 1Password apps | Fill an item by selecting:
|
| 1Password in the browser | Fill an item by selecting:
|
other
Item usage actions are only captured from devices using 1Password 8.4.0 or later. The other value indicates the action was performed using an earlier version of 1Password and is unknown.
| Client | Behavior |
|---|---|
| 1Password apps | Action is unknown. |
reveal
| Client | Behavior |
|---|---|
| 1Password apps | Preview a file. Reveal a password. Show a password in large type. |
| 1Password in the browser | Reveal a password. Show a password in large type. |
secure-copy
| Client | Behavior |
|---|---|
| 1Password apps | Copy an item field. Copy an item's password history. |
| 1Password in the browser | Copy an item field. Copy an item in JSON format. |
select-sso-provider
| Client | Behavior |
|---|---|
| 1Password in the browser | Sign in to a site using a sign-in provider. |
server-create
The server prefix indicates that the action occurred on the server rather than in the client app.
| Client | Behavior |
|---|---|
| 1Password apps | Duplicate an item. Move an item. |
| 1Password.com | Create an item. Duplicate an item. |
| 1Password CLI | Create an item. |
| 1Password Connect server | Create an item. |
server-fetch
The server prefix indicates that the action occurred on the server rather than the client app. server-fetch is a special kind of action type that isn't used by most clients. It's only used when the client reporting the usage is a web server, like 1Password Connect server.
| Client | Behavior |
|---|---|
| 1Password apps | Download a file. Preview a file. |
| 1Password.com | Open an item. |
| 1Password CLI | Open an item. |
| 1Password Connect server | Get all of an item's files. Get the contents of a file. Get the details of a file. Get the details of an item. |
server-update
The server prefix indicates that the action occurred on the server rather than the client app.
| Client | Behavior |
|---|---|
| 1Password apps | Add an item to Favorites. Archive an item. Delete an item. Edit an item. Move an item. Restore an item. |
| 1Password in the browser | Add an item to Favorites. |
| 1Password.com | Add an item to Favorites. Archive an item. Delete an item. Edit an item. Restore an item. |
| 1Password CLI | Archive an item. Delete an item. Edit an item. |
| 1Password Connect server | Delete an item. Edit an item. Replace an item. |
share
| Client | Behavior |
|---|---|
| 1Password apps | Copy an item in JSON format. Duplicate an item. Move an item. Share a link to an item. |
| 1Password.com | Share a link to an item. |