1Password Events Reporting item usage actions
You can use the 1Password Events API to send your 1Password account activity to your security information and event management (SIEM) system, including item usage.
ItemUsage objects contain actions, which describe how an item was used.
Actions are only captured from client apps using 1Password 8.4.0 or later.
Item usage action values
Possible values for action include enter-item-edit-mode, export, fill, reveal, secure-copy, select-sso-provider, server-create, server-fetch, server-update, and share. The behaviors that trigger each type of action are grouped below by 1Password client type.
enter-item-edit-mode
| Client | Behavior |
|---|
| 1Password apps | Click Edit, then modify an item. |
|---|
| Click Edit, then cancel. |
| Click Add to Favorites. |
export
| Client | Behavior |
|---|
| 1Password apps | Download a file. |
|---|
| Export as CSV. Usage is recorded for every exported item. |
| Export as 1PUX. Usage is recorded for every exported item. |
fill
| Client | Behavior |
|---|
| 1Password apps | Click Open and Fill. |
|---|
| 1Password in the browser | Click Open and Fill. |
|---|
reveal
| Client | Behavior |
|---|
| 1Password apps | Preview a file. |
|---|
| Click Show in Large Type. |
| Click Reveal. |
| 1Password in the browser | Click Show in Large Type. |
|---|
| Click Reveal. |
select-sso-provider
| Client | Behavior |
|---|
| 1Password in the browser | Click Sign In on a social login notification. |
|---|
secure-copy
| Client | Behavior |
|---|
| 1Password apps | Copy password history. |
|---|
| Click Copy. |
| 1Password in the browser | Click Copy Item JSON. |
|---|
| Click Copy. |
server-create
The server prefix indicates that the action occurred on the server rather than in the client app.
| Client | Behavior |
|---|
| 1Password apps | Move an item. |
|---|
| 1Password.com | Create an item. |
|---|
| 1Password CLI | Create an item. |
|---|
| 1Password Connect server | Create an item. |
|---|
server-fetch
The server prefix indicates that the action occurred on the server rather than the client app. server-fetch is a special kind of action type that isn't used by most clients. It's only used when the client reporting the usage is a web server, like 1Password Connect server.
| Client | Behavior |
|---|
| 1Password apps | Download a file. |
|---|
| Preview a file. |
| 1Password.com | Open an item. |
|---|
| 1Password CLI | Open an item. |
|---|
| 1Password Connect server | Get the contents of a file. |
|---|
| Get the details of a file. |
| Get all of an item's files. |
| Get the details of an item. |
server-update
The server prefix indicates that the action occurred on the server rather than the client app.
| Client | Behavior |
|---|
| 1Password apps | Delete an item. |
|---|
| Restore an item. |
| Archive an item. |
| Move an item. |
| Click Edit, then modify an item. |
| Click Add to Favorites. |
| 1Password in the browser | Click Add to Favorites. |
|---|
| 1Password.com | Click Add to Favorites. |
|---|
| Delete an item. |
| Restore an item. |
| Update an item. |
| Archive an item. |
| 1Password CLI | Delete an item. |
|---|
| Archive an item. |
| Update an item. |
| 1Password Connect server | Update an item. |
|---|
| Delete an item. |
| Replace an item. |
share
| Client | Behavior |
|---|
| 1Password apps | Move an item. |
|---|
| Duplicate an item. |
| Click Copy Item JSON. |
| Share a link to an item. |
Other
In 1Password 7, and earlier clients, actions aren't recorded with the same specificity. Item usage objects may include an other event, which indicates that one or more actions occurred to an item, but not the specific action type.
Learn more