1Password Events Reporting item usage actions

You can use the 1Password Events API to send your 1Password account activity to your security information and event management (SIEM) system, including item usage.

ItemUsage objects contain actions, which describe how an item was used.

caution

Actions are only captured from client apps using 1Password 8.4.0 or later.

Item usage activity is only sent when client apps sync to the 1Password server. Not all item usage triggers a sync, so there may be delays before actions are received.

Item usage action values

Possible values for action include enter-item-edit-mode, export, fill, other, reveal, secure-copy, select-sso-provider, server-create, server-fetch, server-update, and share. The behaviors that trigger each type of action are grouped below by 1Password client type.

enter-item-edit-mode

Client	Behavior
1Password apps	Select Edit, then modify an item.
	Select Edit, then cancel.
	Select Add to Favorites.

export

Client	Behavior
1Password apps	Download a file.
	Export as CSV. Usage is recorded for every exported item.
	Export as 1PUX. Usage is recorded for every exported item.

fill

Client	Behavior
1Password apps	Select Open and Fill.
1Password for Windows	Select Type in Window.
1Password in the browser	Select Open and Fill.

other

Item usage actions are only captured from devices using 1Password 8.4.0 or later. The other value indicates the action was performed using an earlier version of 1Password and is unknown.

Client	Behavior
1Password apps	Action is unknown.

reveal

Client	Behavior
1Password apps	Preview a file.
	Select Show in Large Type.
	Select Reveal.
1Password in the browser	Select Show in Large Type.
	Select Reveal.

secure-copy

Client	Behavior
1Password apps	Copy password history.
	Select Copy.
1Password in the browser	Select Copy Item JSON.
	Select Copy.

select-sso-provider

Client	Behavior
1Password in the browser	Select Sign In on a social login notification.

server-create

The server prefix indicates that the action occurred on the server rather than in the client app.

Client	Behavior
1Password apps	Create or move an item.
1Password.com	Create an item.
1Password CLI	Create an item.
1Password Connect server	Create an item.

server-fetch

The server prefix indicates that the action occurred on the server rather than the client app. server-fetch is a special kind of action type that isn't used by most clients. It's only used when the client reporting the usage is a web server, like 1Password Connect server.

Client	Behavior
1Password apps	Download a file.
	Preview a file.
1Password.com	Open an item.
1Password CLI	Open an item.
1Password Connect server	Get the contents of a file.
	Get the details of a file.
	Get all of an item's files.
	Get the details of an item.

server-update

The server prefix indicates that the action occurred on the server rather than the client app.

Client	Behavior
1Password apps	Delete an item.
	Restore an item.
	Archive an item.
	Move an item.
	Select Edit, then modify an item.
	Select Add to Favorites.
1Password in the browser	Select Add to Favorites.
1Password.com	Select Add to Favorites.
	Delete an item.
	Restore an item.
	Update an item.
	Archive an item.
1Password CLI	Delete an item.
	Archive an item.
	Update an item.
1Password Connect server	Update an item.
	Delete an item.
	Replace an item.

share

Client	Behavior
1Password apps	Move an item.
	Duplicate an item.
	Select Copy Item JSON.
	Share a link to an item.

Learn more

• Get started with 1Password Events Reporting
• 1Password Events API reference
• Get started with 1Password Events Reporting and Elastic
• Get started with 1Password Events Reporting and Splunk
• 1Password command-line tool: Full documentation