# Give every shared 1Password login an owner and a rotation date

> An inventory of every shared login in 1Password, with a named owner, a rotation schedule, and a private nudge for anyone who is overdue.

- Workflow type: app
- Services: 1Password, Slack Bot, Jira
- Categories: Operations, Engineering
- Published: 2026-08-14

## What it does

- Pulls every credential in your shared 1Password vaults into one table showing the vault it lives in, its tags, who owns it, its rotation schedule, how long since it was last changed, and when it was last actually used.
- Lets you click any row to assign an owner, pick a rotation schedule of 30, 60, 90, or 180 days, and record that you rotated it today. All three are saved onto the 1Password item itself, so the ownership record travels with the credential instead of drifting in a side spreadsheet.
- Colours anything past its rotation date red and anything due within a week amber, with one click filters for overdue, unowned, and never used, plus a separate tab for deletion candidates that nobody has touched in 180 days.
- Sends every owner a private Slack message listing only their own overdue logins, and opens a Jira ticket for a single credential with the vault and last rotated date already filled in.

## What you'll need

- A 1Password Business or Enterprise account with a Connect server already running, plus an access token that can reach the shared vaults you want covered.
- An events reporting token from 1Password if you want the last used column and the deletion candidates tab. Without it the rest of the app still works.
- A Slack workspace, so owners can be messaged privately about their own overdue logins.
- A Jira project where rotation tickets should be filed.

## Prompt

I want an app that gives every shared login in our 1Password account a named owner and a rotation schedule. Right now nobody owns these credentials, so nobody ever rotates them. The app is where I fix that, and the ownership record has to live on the 1Password item itself rather than in a separate database that quietly drifts out of date.

The main view is an inventory table covering every shared vault. Build it with 1Password List Vaults to find the vaults, List Items for each vault, and then Get Item Details for each item, because List Items deliberately omits sections and field values and the ownership metadata lives in those fields. Each row shows the credential title, its vault, its tags, the assigned owner, the rotation cadence, the number of days since it was last rotated, and the date it was last actually used. Pull the last used date from List Item Usages. Give the table quick filters for overdue, unowned, and never used, plus a text search over title and vault.

Clicking a row opens a detail panel for that credential where I can assign an owner, choose a rotation cadence of 30, 60, 90, or 180 days, and mark the credential as rotated today. Write all three back onto the 1Password item with Patch Item Attributes, which takes a JSON Patch document. Store the owner and the last rotated date as custom fields on the item, and reflect the cadence as both a field and a tag so it is visible from inside 1Password. Never display or edit the secret value of a credential in this app, even though the item details response contains it.

Colour the days since last rotation column red once the credential is past its cadence, and amber when it is within seven days of being due. Treat a credential with no owner recorded as unmanaged, make that obvious in the table, and include it in the unowned filter. A credential with an owner but no cadence set should still count as overdue once it is a year old.

Add a Nudge owners button above the table. It groups every overdue credential by its assigned owner and sends each owner a private Slack message listing only their own overdue logins, with the vault name and how many days past due each one is. Resolve each owner to a Slack account with Slack Bot Look Up User by Email, then send the direct message with Slack Bot Send a Message. Owners with nothing overdue get no message. When the run finishes, report inside the app how many messages went out and which owners could not be matched to a Slack account.

In the row detail panel, add an Open rotation ticket button that files a single Jira issue for that one credential using Jira Create Issue. Prefill the summary with the credential title, and the description with the vault, the assigned owner, the cadence, the last rotated date, and how many days overdue it is. Let me choose the Jira project and issue type in app settings. Write the resulting issue key back onto the 1Password item as a field and show it on the row, so nobody files a duplicate ticket for the same credential.

Give deletion candidates their own tab. A deletion candidate is any credential with zero recorded usage in the last 180 days. Show the same columns there, sorted by longest unused first, and allow the same owner assignment and ticket filing from that tab, so I can either claim a credential or raise the work to remove it.

The item reads and writes need a 1Password Connect server credential, while the last used column and the deletion candidates tab need a separate 1Password Events API token. Make the app degrade gracefully. If only the Connect credential is connected, still render the full inventory and every ownership feature, show the last used column as unavailable rather than empty, and explain in the never used filter and the deletion candidates tab that they need the events reporting credential. Connect vault and item identifiers are 26 character lowercase alphanumeric strings.

Because the inventory needs one detail fetch per item, load vaults and items first, render the table quickly from what that returns, and fill in the field level metadata progressively behind a visible progress indicator instead of blocking on the whole account. Keep the assembled inventory for the session with a manual refresh button, and refresh a single row in place after I assign an owner, change a cadence, or mark a rotation.

## How to customize

- Swap the 30, 60, 90, and 180 day rotation choices for whatever your own policy uses.
- Move the amber warning window, currently one week before a credential is due, and the 180 day cutoff that defines a deletion candidate.
- Send the nudges to a security channel instead of private messages, or change which Jira project and issue type new rotation tickets land in.
- Limit the inventory to specific vaults if some shared vaults are out of scope.

## FAQ

### Where does the owner and rotation information actually get stored?

On the 1Password item itself, as custom fields and tags. There is no separate database to keep in sync, so anyone who opens the credential in 1Password can see who owns it, and the record follows the credential if it gets renamed or moved to another vault.

### Does the app show or change the passwords themselves?

No. It only reads and writes the ownership and rotation notes attached to each item. Password values are never displayed in the app, and rotating the actual password stays something a person does in 1Password and then records here.

### Do I need the events reporting side of 1Password?

Only for the last used column, the never used filter, and the deletion candidates tab. If you connect just the Connect server token, the inventory, ownership, rotation tracking, Slack nudges, and Jira tickets all still work and the last used column is marked unavailable.

### What counts as a deletion candidate?

Any credential with zero recorded usage in the last 180 days. They get their own tab, sorted by longest unused first, so you can either claim them or raise a ticket to remove them.

### Will this work on a personal or family 1Password plan?

No. It relies on the Connect server and events reporting features, which are part of the business and enterprise plans.

Use this prompt in General Input: https://www.generalinput.com/prompts/give-every-shared-1password-login-an-owner-and-a-rotation-date