# 1Password integration

> Read and write vaults, items, and files through a self-hosted 1Password Connect server, and query audit events, item usage, and sign-in attempts through the 1Password Events API.

- Authentication: apiKey

## Tools (19)

- **Create Item**: Create a new item in a vault, optionally having 1Password generate field values.
- **Delete Item**: Permanently delete an item from a vault.
- **Download File Content**: Download the raw bytes of a file attachment.
- **Get File Details**: Fetch metadata for one file attachment, optionally with its content inlined.
- **Get Item Details**: Retrieve a single item with all of its sections, fields, and secret values.
- **Get Prometheus Metrics**: Scrape the Connect server's Prometheus metrics.
- **Get Server Health**: Check the Connect server's version and the state of its service dependencies.
- **Get Server Heartbeat**: Ping the Connect server to confirm it is reachable.
- **Get Vault Details**: Fetch metadata for a single vault by its UUID.
- **Introspect Events Token**: Check which Events API feature streams the bearer token may read, and which account issued it.
- **List API Activity**: List the API requests served by the Connect server, for auditing token use.
- **List Audit Events**: Poll administrative and team member actions performed within the account.
- **List Item Files**: List file attachments on an item, optionally inlining small file contents.
- **List Items**: List the items in a vault, without their sections or field values.
- **List Item Usages**: Poll every access of an item stored in a shared vault in the account.
- **List Sign-in Attempts**: Poll sign-in attempts for the account, including failures and their causes.
- **List Vaults**: List every vault the Connect access token has been granted access to.
- **Patch Item Attributes**: Add, remove, or replace individual item attributes or fields with a JSON Patch document.
- **Replace Item**: Overwrite an entire item with a new full item body.

## Triggers (3)

- **New Sign-in Attempt in 1Password**: Triggers on new 1Password sign-in attempts, successful or failed. Filter to failure categories (e.g. "credentials_failed, mfa_failed") to watch for suspicious access. Requires an Events API credential whose token holds the signinattempts feature.
- **New Audit Event in 1Password**: Triggers on new administrative and team member actions in the 1Password account (invites, grants, vault changes, device authorizations). Requires an Events API credential whose token holds the auditevents feature.
- **New Item Usage in 1Password**: Triggers when an item in a shared vault is accessed or modified. Scope to a vault or item to watch sensitive credentials. Requires an Events API credential whose token holds the itemusages feature.

## Related prompts

- [Triage 1Password sign-in failures without alerting on typos](https://www.generalinput.com/prompts/triage-1password-sign-in-failures-without-alerting-on-typos.md)
- [Flag risky 1Password vault access against your HR records](https://www.generalinput.com/prompts/flag-risky-1password-vault-access-against-your-hr-records.md)
- [Weekly 1Password vault audit with Slack digest and Jira tickets](https://www.generalinput.com/prompts/weekly-1password-vault-audit-with-slack-digest-and-jira-tickets.md)
- [Keep a nightly 1Password activity log in Google Sheets](https://www.generalinput.com/prompts/keep-a-nightly-1password-activity-log-in-google-sheets.md)

Connect 1Password in General Input: https://www.generalinput.com/apps/1password