Manage your Events Reporting integrations

Create an Events Reporting integration to connect your business or enterprise account to the 1Password Events API, and use the integration to manage the bearer tokens for authenticating requests. You can use the same Events Reporting integration and bearer tokens with both the v2 production API and the v3 beta. You can also use separate integrations for each version.

​

Requirements

To manage Events Reporting integrations, you’ll need:

• A 1Password Business or 1Password Enterprise Password Manager account (not included with 1Password Teams).
• Permissions to manage integrations in your 1Password account (for example, as an owner, administrator, or member of the Security group).

​

Manage your Events Reporting integrations

​

Create an integration

When you create a new Events Reporting integration, you’ll also issue its first bearer token.

1. Sign in to your account on 1Password.com.
2. Select Integrations in the sidebar. If you’ve set up other integrations in your account, you’ll also need to select Directory on the Integrations page.
3. In the Events Reporting section, choose your SIEM from the list. If your SIEM isn’t listed, select Other.
4. Enter a name for the integration, then select Add Integration.
5. Set up a bearer token:
   • Token Name: Enter a name for the token.
   • Expires After: (Optional) Choose when the token will expire: 30 days, 90 days, 180 days, or Never (default).
   • Events to Report: Choose which events the token can access. The default scope includes all events: sign-in attempts, item usages, and audit events. Learn more about token scopes.
6. Select Issue Token.
7. On the “Save your token” page, select Save in 1Password. Choose the vault where you want to save your token, then select Save.
   Your bearer token will be saved as an API Credential item in 1Password.
8. Select View Integration Details.

After you create the integration, use the bearer token to send a test request, then connect your account to your SIEM.

​

View or delete an integration

To see the details of an Events Reporting integration you’ve already set up:

1. Sign in to your account on 1Password.com and select Integrations in the sidebar.
2. In the Events Reporting section, select the integration you want to see its details.

In the Tokens section, you’ll see the name, scope, and expiry information for each bearer token that’s been issued. You can also issue new tokens or revoke tokens for the integration. If you need to change the name of the integration, or connect to a different SIEM or client, you’ll need to create a new integration. To delete an integration:

1. Select More Actions on the integration details page, then select Delete.
2. Enter your account password, then select Delete Integration.

​

Manage bearer tokens

You can issue one or more bearer tokens for your Events Reporting integration. For example, you can issue separate tokens for different SIEMs or environments, or issue a token for the v3 beta while your v2 integration continues to use its existing token. You can issue, rotate, and revoke bearer tokens at any time.

​

Token scopes

When you issue a bearer token, you’ll choose which events it can access. The v3 beta endpoint only requires a token scoped to audit events. If you want to use the same token with v2 endpoints, you can also scope it to include item usages and sign-in attempts. This won’t impact how the token is used with the v3 beta API. To verify which events an existing bearer token can access, check the integration details on 1Password.com:

1. Sign in to your account on 1Password.com and select Integrations in the sidebar.
2. Choose the Events Reporting integration where you want to verify the scope of a token.
3. Locate your bearer token in the Tokens section and check which events it can access. You’ll also see when or if the token is set to expire.

Learn more about the beta API.

​

Issue a bearer token

To issue a new bearer token for an existing integration:

1. Sign in to your account on 1Password.com and select Integrations in the sidebar.
2. Choose the Events Reporting integration where you want to issue a token and select Add a token.
3. Set up a new bearer token:
   • Token Name: Enter a name for the token.
   • Expires After: (Optional) Choose when the token will expire: 30 days, 90 days, 180 days, or Never (default).
   • Events to Report: Choose which events the token can access. The default scope includes all events: sign-in attempts, item usages, and audit events. Learn more about token scopes.
4. Select Issue Token.
5. On the “Save your token” page, select Save in 1Password. Choose the vault where you want to save your token, then select Save.
   Your bearer token will be saved as an API Credential item in 1Password.

If you set a bearer token to expire, you can also edit the token item you saved in 1Password to add the token’s expiry date.

​

Rotate a bearer token

To replace a bearer token without interrupting event ingestion:

1. Issue a new bearer token in the same integration, scoped to audit events.
   If the bearer token is also used for v2, include any additional scopes that are required.
2. Update your SIEM or client to use the new token.
3. Confirm your SIEM or client is receiving events with the new token.
4. Revoke the old token.

If your token is set to expire, rotate it before the expiry date.

​

Revoke a bearer token

To revoke a bearer token:

1. Sign in to your account on 1Password.com and select Integrations in the sidebar.
2. Choose the Events Reporting integration where you want to revoke a token.
3. Select the gear button next to the token you want to revoke, then select Revoke.

Requests that use a revoked token return a 401 Unauthorized response.

​

Learn more

• About the Events API beta
• Get started with the beta API
• Beta API conventions