1Password Events Reporting item usage actions
You can use the 1Password Events API to send your 1Password account activity to your security information and event management (SIEM) system, including item usage.
ItemUsage objects contain actions, which describe how an item was used.
Actions are only captured from client apps using 1Password 8.4.0 or later.
Item usage activity is only sent when client apps sync to the 1Password server. Not all item usage triggers a sync, so there may be delays before actions are received.
Item usage action values
Possible values for action
include enter-item-edit-mode
, export
, fill
, other
, reveal
, secure-copy
, select-sso-provider
, server-create
, server-fetch
, server-update
, and share
. The behaviors that trigger each type of action are grouped below by 1Password client type.
enter-item-edit-mode
Client | Behavior |
---|
1Password apps | Select Edit, then modify an item. |
---|
Select Edit, then cancel. |
Select Add to Favorites. |
export
Client | Behavior |
---|
1Password apps | Download a file. |
---|
Export as CSV. Usage is recorded for every exported item. |
Export as 1PUX. Usage is recorded for every exported item. |
fill
Client | Behavior |
---|
1Password apps | Select Open and Fill. |
---|
1Password in the browser | Select Open and Fill. |
---|
other
Item usage actions are only captured from devices using 1Password 8.4.0 or later. The other
value indicates the action was performed using an earlier version of 1Password and is unknown.
Client | Behavior |
---|
1Password apps | Action is unknown. |
---|
reveal
Client | Behavior |
---|
1Password apps | Preview a file. |
---|
Select Show in Large Type. |
Select Reveal. |
1Password in the browser | Select Show in Large Type. |
---|
Select Reveal. |
secure-copy
Client | Behavior |
---|
1Password apps | Copy password history. |
---|
Select Copy. |
1Password in the browser | Select Copy Item JSON. |
---|
Select Copy. |
select-sso-provider
Client | Behavior |
---|
1Password in the browser | Select Sign In on a social login notification. |
---|
server-create
The server
prefix indicates that the action occurred on the server rather than in the client app.
Client | Behavior |
---|
1Password apps | Move an item. |
---|
1Password.com | Create an item. |
---|
1Password CLI | Create an item. |
---|
1Password Connect server | Create an item. |
---|
server-fetch
The server
prefix indicates that the action occurred on the server rather than the client app. server-fetch
is a special kind of action type that isn't used by most clients. It's only used when the client reporting the usage is a web server, like 1Password Connect server.
Client | Behavior |
---|
1Password apps | Download a file. |
---|
Preview a file. |
1Password.com | Open an item. |
---|
1Password CLI | Open an item. |
---|
1Password Connect server | Get the contents of a file. |
---|
Get the details of a file. |
Get all of an item's files. |
Get the details of an item. |
server-update
The server
prefix indicates that the action occurred on the server rather than the client app.
Client | Behavior |
---|
1Password apps | Delete an item. |
---|
Restore an item. |
Archive an item. |
Move an item. |
Select Edit, then modify an item. |
Select Add to Favorites. |
1Password in the browser | Select Add to Favorites. |
---|
1Password.com | Select Add to Favorites. |
---|
Delete an item. |
Restore an item. |
Update an item. |
Archive an item. |
1Password CLI | Delete an item. |
---|
Archive an item. |
Update an item. |
1Password Connect server | Update an item. |
---|
Delete an item. |
Replace an item. |
share
Client | Behavior |
---|
1Password apps | Move an item. |
---|
Duplicate an item. |
Select Copy Item JSON. |
Share a link to an item. |
Learn more