1Password Events API

Can I monitor which vault items were accessed with the Events API?

Yes. Use POST /api/v1/itemusages to retrieve item usage records. Each record includes the user who accessed the item, the item name and vault, the client application used, and the timestamp. You can paginate through results using cursor-based pagination to process large datasets incrementally.

What are the rate limits for the 1Password Events API?

The 1Password Events API enforces rate limits per service account token. The API returns 429 status codes when limits are exceeded. Use cursor-based pagination to retrieve events incrementally rather than requesting the full history in a single call, which helps stay within rate limits.

How do I detect failed sign-in attempts through Jentic?

Search Jentic for 'detect failed authentication attempts', which returns the POST /api/v1/signinattempts operation. Query sign-in attempts filtered by timestamp, and check the success field to identify failures. Each record includes the IP address, country, and MFA method used. Install with pip install jentic and run it through Jentic One, the self-hosted execution layer.

Which regional endpoints does the 1Password Events API support?

The Events API supports three regional endpoints for data residency compliance: US (events.1password.com), Canada (events.1password.ca), and EU (events.1password.eu). Your service account token determines which region to use based on your 1Password Business account location.

Can I use cursor-based pagination to avoid duplicate events?

Yes. All three event endpoints (auditevents, itemusages, signinattempts) support cursor-based pagination. The response includes a cursor value that marks your position in the event stream. Store this cursor between requests and pass it in subsequent calls to retrieve only new events since your last query, ensuring no duplicates.

Does the Events API provide real-time streaming?

The Events API uses a polling model with cursor-based pagination rather than real-time streaming. Poll the endpoints at regular intervals (recommended 1-5 minutes) using your stored cursor to retrieve new events incrementally. This approach works well for SIEM integrations that process events in batches.

Can I limit what my agent is allowed to do with the 1Password Events API?

Yes. Because you run Jentic One self-hosted, your own rules decide which operations and credentials the agent may use. Since the Events API selects records through request-body filters like cursors and date ranges rather than a resource id in the path, you scope the agent to only the operations it needs, such as reading audit events, item usages, or sign-in attempts, and leave the token introspection endpoints out unless you add them. Only the operations you pick can run, and the service-account token is injected at execution time without entering the agent's context.