Teams and Businesses

1Password Events Reporting item usage actions

Learn about item usage actions in the 1Password Events API.

You can use the 1Password Events API to send your 1Password account activity to your security information and event management (SIEM) system, including item usage.

ItemUsage objects contain actions, which describe how an item was used.

Tip

Actions are only captured from client apps using 1Password 8.4.0 or later.

Item usage action values

Possible values for action include fill, enter-item-edit-mode, export, share, secure-copy, reveal, server-create, server-update, and server-fetch. The behaviors that trigger each type of action are grouped below by 1Password client type.

enter-item-edit-mode

ClientBehavior
1Password 8Click Edit, then modify an item.
Click Edit, then cancel.
Click Add to Favorites.

export

ClientBehavior
1Password 8Download a file.
Export as CSV.

Usage is recorded for every exported item.

Export as 1PUX.

Usage is recorded for every exported item.

fill

ClientBehavior
1Password 8Click Open and Fill.
1Password in the browserClick Open and Fill.

reveal

ClientBehavior
1Password 8Preview a file.
Click Show in Large Type.
Click Reveal.
1Password in the browserClick Show in Large Type.
Click Reveal.

secure-copy

ClientBehavior
1Password 8Copy password history.
Click Copy.
1Password in the browserClick Copy Item JSON.
Click Copy.

server-create

The server prefix indicates that the action occurred on the server rather than in the client app.

ClientBehavior
1Password 8Move an item.
1Password.comCreate an item.
1Password CLICreate an item.
1Password Connect serverCreate an item.

server-fetch

The server prefix indicates that the action occurred on the server rather than the client app. server-fetch is a special kind of action type that isn’t used by most clients. It’s only used when the client reporting the usage is a web server, like 1Password Connect server.

ClientBehavior
1Password 8Download a file.
Preview a file.
1Password.comOpen an item.
1Password CLIOpen an item.
1Password Connect serverGet the contents of a file.
Get the details of a file.
Get all of an item's files.
Get the details of an item.

server-update

The server prefix indicates that the action occurred on the server rather than the client app.

ClientBehavior
1Password 8Delete an item.
Restore an item.
Archive an item.
Move an item.
Click Edit, then modify an item.
Click Add to Favorites.
1Password in the browserClick Add to Favorites.
1Password.comClick Add to Favorites.
Delete an item.
Restore an item.
Update an item.
Archive an item.
1Password CLIDelete an item.
Archive an item.
Update an item.
1Password Connect serverUpdate an item.
Delete an item.
Replace an item.

share

ClientBehavior
1Password 8Move an item.
Duplicate an item.
Click Copy Item JSON.

Other

In 1Password 7, and earlier clients, actions aren’t recorded with the same specificity. Item usage objects may include an other event, which indicates that one or more actions occurred to an item, but not the specific action type.

Learn more

Still need help?

If this article didn't answer your question, contact 1Password Support.

Published: