> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage your Events Reporting integrations

> Learn how to create, view, and delete Events Reporting integrations, and how to issue, rotate, verify, and revoke bearer tokens for the 1Password Events API.

Create an Events Reporting integration to connect your business or enterprise account to the 1Password Events API, and use the integration to manage the bearer tokens for authenticating requests.

You can use the same Events Reporting integration and bearer tokens with both the [v2 production API](https://www.1password.dev/events-api.md) and the [v3 beta](https://www.1password.dev/events-api/beta.md). You can also use separate integrations for each version.

## Requirements

To manage Events Reporting integrations, you'll need:

* A [1Password Business](https://1password.com/business-security) or [1Password Enterprise Password Manager](https://1password.com/product/enterprise-password-manager) account (not included with 1Password Teams).
* Permissions to manage integrations in your 1Password account (for example, as an [owner](https://support.1password.com/groups/#owners), [administrator](https://support.1password.com/groups/#administrators), or member of the [Security group](https://support.1password.com/groups/#security)).

## Manage your Events Reporting integrations

### Create an integration

When you create a new Events Reporting integration, you'll also issue its first bearer token.

1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com.
2. Select [**Integrations**](https://start.1password.com/integrations/directory) in the sidebar. If you've set up other integrations in your account, you'll also need to select **Directory** on the Integrations page.
3. In the Events Reporting section, choose your SIEM from the list. If your SIEM isn't listed, select **Other**.
4. Enter a name for the integration, then select **Add Integration**.
5. Set up a bearer token:
   * **Token Name**: Enter a name for the token.
   * **Expires After**: (Optional) Choose when the token will expire: 30 days, 90 days, 180 days, or Never (default).
   * **Events to Report**: Choose which events the token can access. The default scope includes all events: sign-in attempts, item usages, and audit events. Learn more about [token scopes](#token-scopes).
6. Select **Issue Token**.
7. On the "Save your token" page, select **Save in 1Password**. Choose the vault where you want to save your token, then select **Save**. \
   Your bearer token will be saved as an [API Credential item](https://support.1password.com/item-categories/#api-credential) in 1Password.
8. Select **View Integration Details**.

After you create the integration, use the bearer token to [send a test request](https://www.1password.dev/events-api/beta/get-started.md#step-3-send-a-test-request-with-curl), then connect your account to your SIEM.

### View or delete an integration

To see the details of an Events Reporting integration you've already set up:

1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com and select [**Integrations**](https://start.1password.com/integrations/active) in the sidebar.
2. In the Events Reporting section, select the integration you want to see its details.

In the Tokens section, you'll see the name, scope, and expiry information for each bearer token that's been issued. You can also [issue new tokens](#issue-a-bearer-token) or [revoke tokens](#revoke-a-bearer-token) for the integration.

If you need to change the name of the integration, or connect to a different SIEM or client, you'll need to [create a new integration](#create-an-integration).

To delete an integration:

1. Select **More Actions** on the integration details page, then select **Delete**.
2. Enter your account password, then select **Delete Integration**.

## Manage bearer tokens

You can issue one or more bearer tokens for your Events Reporting integration. For example, you can issue separate tokens for different SIEMs or environments, or issue a token for the v3 beta while your v2 integration continues to use its existing token.

You can [issue](#issue-a-bearer-token), [rotate](#rotate-a-bearer-token), and [revoke](#revoke-a-bearer-token) bearer tokens at any time.

### Token scopes

When you issue a bearer token, you'll choose which events it can access. The v3 beta endpoint only requires a token scoped to audit events. If you want to use the same token with v2 endpoints, you can also scope it to include item usages and sign-in attempts. This won't impact how the token is used with the v3 beta API.

To verify which events an existing bearer token can access, check the integration details on 1Password.com:

1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com and select [**Integrations**](https://start.1password.com/integrations/active) in the sidebar.
2. Choose the Events Reporting integration where you want to verify the scope of a token.
3. Locate your bearer token in the Tokens section and check which events it can access. You'll also see when or if the token is set to expire.

[Learn more about the beta API.](https://www.1password.dev/events-api/beta.md#about-the-v3-beta-api)

### Issue a bearer token

To issue a new bearer token for an existing integration:

1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com and select [**Integrations**](https://start.1password.com/integrations/active) in the sidebar.
2. Choose the Events Reporting integration where you want to issue a token and select **Add a token**.
3. Set up a new bearer token:
   * **Token Name**: Enter a name for the token.
   * **Expires After**: (Optional) Choose when the token will expire: 30 days, 90 days, 180 days, or Never (default).
   * **Events to Report**: Choose which events the token can access. The default scope includes all events: sign-in attempts, item usages, and audit events. Learn more about [token scopes](#token-scopes).
4. Select **Issue Token**.
5. On the "Save your token" page, select **Save in 1Password**. Choose the vault where you want to save your token, then select **Save**. \
   Your bearer token will be saved as an [API Credential item](https://support.1password.com/item-categories/#api-credential) in 1Password.

If you set a bearer token to expire, you can also edit the token item you saved in 1Password to add the token's expiry date.

### Rotate a bearer token

To replace a bearer token without interrupting event ingestion:

1. [Issue a new bearer token](#issue-a-bearer-token) in the same integration, scoped to audit events. \
   If the bearer token is also used for v2, include any additional scopes that are required.
2. Update your SIEM or client to use the new token.
3. Confirm your SIEM or client is receiving events with the new token.
4. [Revoke the old token](#revoke-a-bearer-token).

If your token is set to expire, rotate it before the expiry date.

### Revoke a bearer token

> [!WARNING]
>
> Your SIEM will stop ingesting events after a token is revoked. To minimize downtime, [rotate the token](#rotate-a-bearer-token), then issue the replacement token before you revoke the old one.

To revoke a bearer token:

1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com and select [**Integrations**](https://start.1password.com/integrations/active) in the sidebar.
2. Choose the Events Reporting integration where you want to revoke a token.
3. Select the gear button next to the token you want to revoke, then select **Revoke**.

Requests that use a revoked token return a `401 Unauthorized` response.

## Learn more

* [About the Events API beta](https://www.1password.dev/events-api/beta.md)
* [Get started with the beta API](https://www.1password.dev/events-api/beta/get-started.md)
* [Beta API conventions](https://www.1password.dev/events-api/beta/conventions.md)


## Related topics

- [1Password Events API v3 (beta)](https://www.1password.dev/events-api/beta.md)
- [Get started with the 1Password Events API](https://www.1password.dev/events-api/get-started.md)
- [Get started with the 1Password Events API (beta)](https://www.1password.dev/events-api/beta/get-started.md)