> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password Events

> Reference for the Tracecat 1Password Events integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Introspect Events API token

Action ID: `tools.1password.introspect_events_token`

Return the event features and 1Password account authorized for an Events Reporting bearer token. Calls GET /api/v2/auth/introspect directly.

Reference: [https://www.1password.dev/events-api/reference/introspect](https://www.1password.dev/events-api/reference/introspect)

### Secrets

Required secrets:

* `onepassword_events`: required values `OP_EVENTS_API_TOKEN`.

### Input fields

<ParamField path="base_url" type="string | null">
  1Password Events API base URL for the account.

  Default: `null`.
</ParamField>

## List audit events

Action ID: `tools.1password.list_audit_events`

Retrieve actions performed by team members in a 1Password account. Calls POST /api/v2/auditevents directly and requires the token's auditevents feature. The response cursor is a persistent checkpoint for the next call.

Reference: [https://www.1password.dev/events-api/reference/audit-events](https://www.1password.dev/events-api/reference/audit-events)

### Secrets

Required secrets:

* `onepassword_events`: required values `OP_EVENTS_API_TOKEN`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native cursor request body. For a first or reset request, pass any combination of limit (1-1000, default 100), start\_time (RFC 3339), and end\_time (RFC 3339), or pass an empty object. For a continuing request, pass only cursor from the previous response.
</ParamField>

<ParamField path="base_url" type="string | null">
  1Password Events API base URL for the account.

  Default: `null`.
</ParamField>

## List item usages

Action ID: `tools.1password.list_item_usages`

Retrieve events for items in shared 1Password vaults that were modified, accessed, or used. Calls POST /api/v2/itemusages directly and requires the token's itemusages feature. The response cursor is a persistent checkpoint for the next call.

Reference: [https://www.1password.dev/events-api/reference/items-usage](https://www.1password.dev/events-api/reference/items-usage)

### Secrets

Required secrets:

* `onepassword_events`: required values `OP_EVENTS_API_TOKEN`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native cursor request body. For a first or reset request, pass any combination of limit (1-1000, default 100), start\_time (RFC 3339), and end\_time (RFC 3339), or pass an empty object. For a continuing request, pass only cursor from the previous response.
</ParamField>

<ParamField path="base_url" type="string | null">
  1Password Events API base URL for the account.

  Default: `null`.
</ParamField>

## List sign-in attempts

Action ID: `tools.1password.list_sign_in_attempts`

Retrieve successful and failed 1Password account sign-in attempts. Calls POST /api/v2/signinattempts directly and requires the token's signinattempts feature. The response cursor is a persistent checkpoint for the next call.

Reference: [https://www.1password.dev/events-api/reference/sign-in-attempt](https://www.1password.dev/events-api/reference/sign-in-attempt)

### Secrets

Required secrets:

* `onepassword_events`: required values `OP_EVENTS_API_TOKEN`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native cursor request body. For a first or reset request, pass any combination of limit (1-1000, default 100), start\_time (RFC 3339), and end\_time (RFC 3339), or pass an empty object. For a continuing request, pass only cursor from the previous response.
</ParamField>

<ParamField path="base_url" type="string | null">
  1Password Events API base URL for the account.

  Default: `null`.
</ParamField>