1Password Setup

1Password connector setup

Polls the 1Password Events API for sign-in attempts, item usages, and audit events.

What you need first

Requirement	Details
1Password plan	Business or Enterprise
Admin access	Account administrator who can create Events Reporting integrations

---

1. Create an Events Reporting integration

1. Sign in to 1Password.com as an administrator.
2. Open Integrations in the sidebar. If you already have integrations, open Directory first.
3. Under Events Reporting, choose Other (or your security platform vendor if listed).
4. Enter an integration name (e.g. Perpetual 1Password) and click Add Integration.

Issue a bearer token

1. On the integration, click Add a token (or issue the first token during setup).
2. Set a Token name (e.g. Perpetual).
3. Choose Expires After (many teams use Never; shorter expiry requires rotation).
4. Under Events to Report, enable the streams you plan to collect in Perpetual:
   • Sign-in attempts
   • Item usages
   • Audit events
5. Click Issue Token, then Save in 1Password to store the token in a vault.
6. Copy the bearer token value. You will paste it into Perpetual as a Text credential.

---

2. Perpetual credential

1. Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
2. Choose Text.
3. Fill in:

Field	Value
Name	Unique identifier using letters, digits, and underscores only (e.g. one_password).
Allowed URL patterns	*.1password.com, *.1password.eu, *.1password.ca
Value	Bearer token from step 1

4. Save the credential.

---

3. Create the 1Password connector

1. Go to Datasets → Connectors → Create Connector.
2. Select 1Password.
3. Connector name: unique identifier (letters, numbers, underscores; becomes connector.<name>).
4. Space: optional scope for the connector resource.
5. Configure:
   • 1Password API access: select the credential from step 2.
   • Poll interval (minutes): default 5.
   • Region: us, eu, or ca — must match your 1Password account residency.
   • Enable only the streams your token is scoped for:

Setting	Default	API path	Notes
Sign-in attempts	On	/api/v2/signinattempts	Login success/failure, client, location
Item usages	On	/api/v2/itemusages	Vault item views, copies, edits
Audit events	On	/api/v2/auditevents	Vault, group, user, integration changes

At least one stream must stay enabled.

6. Optionally check Deploy to schedule the connector immediately after save.
7. Save.

First run backfills roughly the last 24 hours per enabled stream, then advances cursors on subsequent polls.

---

Operational notes

• Token rotation: Issue a new token in 1Password, update the Perpetual credential, then revoke the old token.
• Stream scope: If a stream is enabled in Perpetual but not on the token, that stream will fail until you issue a new token with the missing event type.

---

Reference

• 1Password Events API — Get started
• 1Password Events API — Authorization
• Events Reporting support guide