Skip to main content
The API can fetch event data from the last 120 days. To access event information prior to that, you can use the audit log in your 1Password Business account.
This catalog provides an extensive, but non-exhaustive, list of audit event actions the API can return, organized by category and type of event. The API may return events that aren’t included in this reference. The action for each event follows a target.attribute.verb format, where the attribute is optional. For example: Event action: service-account.token.create
  • Target: The object the action was performed on (service-account).
  • Attribute: Additional context about the action, when present (token).
  • Verb: The action that was performed (create).
Meaning: A token was created for a service account. For the full shape of an audit event object, see the v3 audit events reference.

Access tokens

Actions related to issuing and revoking API access tokens.

Accounts

Actions related to managing and updating your organization’s account.

Account lifecycle

Account name

Account promotions

Allowed domains

Firewall rules

Linked family accounts

Verified domains

Billing

Actions related to updating billing information and managing Stripe payment data.

Billing information

Promotions

Stripe cards

Stripe payment methods

Stripe subscriptions

Custom email templates

Actions related to updating custom email templates in your organization’s account.

Devices

Actions related to people managing the devices they use to access your organization’s account.

Files

Actions related to adding documents, images, and other files to your organization’s account.

Groups

Actions related to managing groups and group access.

Group keyset

Group lifecycle

Group membership

Integrations

Actions related to managing third-party integrations connected to your organization’s account.

Automated provisioning

Slack app

Invitations

Actions related to sending invitations to people to join your organization’s account.

Item sharing settings

Actions related to changing the settings of a shared item.

Managed accounts

Actions related to managed service provider (MSP) accounts and managed companies.

Copy vaults

External Account Manager group permissions

Federated sessions

Managed company lifecycle

MSP group permissions

MSP role permissions

MSP user role permissions

Managed credentials

Actions related to managing credentials and the accessors, policies, and signed keys that govern them.

Concealed fields

Credential accessors

Credential management

Credential policies

Signed keys

Multi-factor authentication

Actions related to multi-factor authentication (MFA) at the account and user level.

Account MFA

User MFA

OAuth apps

Actions related to managing the OAuth apps connected to your organization’s account.

Policies

Actions related to managing policies for your organization’s account.

Duo

Policy

Policy templates

Actions related to managing policy templates and how they’re applied to child accounts.

Policy template

Policy template child account

Policy template override

Policy template policy

Reports

Actions related to viewing and exporting reports for security issues, account activity, and team insights.

Service accounts

Actions related to managing service accounts and their tokens.

Service account lifecycle

Service account tokens

Settings

Actions related to managing settings in your organization’s account, such as email notifications.

SSO settings

Actions related to managing the single sign-on (SSO) configuration for your organization’s account and the groups it applies to.

SSO configuration

SSO groups

Users

Actions related to managing users in your organization’s account.

Email changes

Migrating user

Sign-in tokens

User delegated session

User lifecycle

User keyset

User migration

User passkey

User password

User provisioning email

User recovery

User secret key

User SSO

User trusted device

Vaults

Actions related to managing vaults and vault access, and tracking when changes are made to items in a vault.

Vault access

Vault item changes

Vault lifecycle

Vault items

Actions related to vault item maintenance.

Item history

Item purge

Item sharing

Vault item templates

Actions related to managing vault item templates.