- Audit events: actions people take in the account, like changes to vaults, groups, and users.
- Item usage: when items in shared vaults are viewed, copied, or edited.
- Sign-in attempts: who signed in, when, and from where, with details on failed attempts.
Try the API in your browser
Paste your token, pick your region, and send a real request from the docs. No code needed.
Quickstart
- Create an Events Reporting integration to get a bearer token and connect your SIEM.
- Send your first request with the Try it panel (below).
- Use the example scripts to pull events on a schedule.
Try it in the docs
Each endpoint page, like Introspect, Audit events, Item usages, and Sign-in attempts, has a Try it panel. Paste your token, pick your region, and send a real request from your browser. No code needed.1
Get a bearer token
Create an Events Reporting integration in your 1Password account to get a bearer token. Get started walks you through it.
2
Start with a read-only call
Open Introspect bearer token. It checks your token and shows which events it can read, without changing anything.
3
Pick your region and paste your token
Select Try it, choose the server that matches your account (1password.com, 1password.ca, 1password.eu, or ent.1password.com), then paste your token in the Authorization field.
4
Send it, then copy the code
Select Send to see the live response. The example panel turns the same request into cURL, Python, JavaScript, Go, and more, ready to paste into your integration.
Reference documentation
- Read the full 1Password Events API reference.
- Learn about audit events.
- Learn about item usage actions.
- Track version changes.