Item usage actions

You can use the 1Password Events API to send your 1Password account activity to your security information and event management (SIEM) system, including item usage. ItemUsage objects contain actions, which describe how an item was used.

​

Item usage action values

Possible values for action include: The behaviors that trigger each type of action are grouped below by 1Password client type.

​

enter-item-edit-mode

Client	Behavior
1Password apps	Add an item to Favorites. Edit an item. Usage is recorded upon selecting Edit, whether or not the item is modified.

​

export

Client	Behavior
1Password apps	Download a file. Export 1Password account data as a 1PUX or CSV file. Usage is recorded for every exported item.

​

fill

Client	Behavior
1Password apps	Fill an item by selecting: “Open and fill" "Type in window” (Windows only)
1Password in the browser	Fill an item by selecting: Autofill Auto-Type (Windows only) Open & Fill An item from the inline menu in a form field

​

other

Item usage actions are only captured from devices using 1Password 8.4.0 or later. The other value indicates the action was performed using an earlier version of 1Password and is unknown.

Client	Behavior
1Password apps	Action is unknown.

​

reveal

Client	Behavior
1Password apps	Preview a file. Reveal a password. Show a password in large type.
1Password in the browser	Reveal a password. Show a password in large type.

​

secure-copy

Client	Behavior
1Password apps	Copy an item field. Copy an item’s password history.
1Password in the browser	Copy an item field. Copy an item in JSON format.

​

select-sso-provider

Client	Behavior
1Password in the browser	Sign in to a site using a sign-in provider.

​

server-create

The server prefix indicates that the action occurred on the server rather than in the client app.

Client	Behavior
1Password apps	Duplicate an item. Move an item.
1Password.com	Create an item. Duplicate an item.
1Password CLI	Create an item.
1Password Connect server	Create an item.

​

server-fetch

The server prefix indicates that the action occurred on the server rather than the client app. server-fetch is a special kind of action type that isn’t used by most clients. It’s only used when the client reporting the usage is a web server, like 1Password Connect server.

Client	Behavior
1Password apps	Download a file. Preview a file.
1Password.com	Open an item.
1Password CLI	Open an item.
1Password Connect server	Get all of an item’s files. Get the contents of a file. Get the details of a file. Get the details of an item.

​

server-update

The server prefix indicates that the action occurred on the server rather than the client app.

Client	Behavior
1Password apps	Add an item to Favorites. Archive an item. Delete an item. Edit an item. Move an item. Restore an item.
1Password in the browser	Add an item to Favorites.
1Password.com	Add an item to Favorites. Archive an item. Delete an item. Edit an item. Restore an item.
1Password CLI	Archive an item. Delete an item. Edit an item.
1Password Connect server	Delete an item. Edit an item. Replace an item.

​

share

Client	Behavior
1Password apps	Copy an item in JSON format. Duplicate an item. Move an item. Share a link to an item.
1Password.com	Share a link to an item.

​

Learn more

• Get started with 1Password Events Reporting
• 1Password Events API reference
• Get started with 1Password Events Reporting and Elastic
• Get started with 1Password Events Reporting and Splunk
• 1Password command-line tool: Full documentation