Manage vault permissions using 1Password SDKs

If you have 1Password Business or 1Password Teams, you can manage your team members’ vault access at the group level. We recommend authenticating with the 1Password desktop app to manage vault permissions. Service accounts can only manage permissions for vaults created by the service account.

Some vault permissions require dependent permissions. You must grant or remove all required dependent permissions or the operation will fail. The permissions available to you depend on your account type. See 1Password Business vault permissions and 1Password Teams vault permissions for more information.

Before you get started

Before you begin, follow the steps to get started with a 1Password SDK. The examples on this page assume you have an initialized client instance. For example:

Go
JavaScript
Python

package main

import (
	"context"

	"github.com/1password/onepassword-sdk-go"
)

func main() {
	// TODO: Initialize client using your preferred authentication method (see Overview > Get started)
	client, err := onepassword.NewClient(context.Background(),
	)
	if err != nil {
		panic(err)
	}

	// Your code here
}

ES Modules
CommonJS

import sdk from "@1password/sdk";

async function main() {
  const client = await sdk.createClient({
    // TODO: Initialize client using your preferred authentication method (see Overview > Get started)
  });

  // Your code here
}

main().catch(console.error);

const sdk = require("@1password/sdk");

async function main() {
  const client = await sdk.createClient({
    // TODO: Initialize client using your preferred authentication method (see Overview > Get started)
  });

  // Your code here
}

main().catch(console.error);

import asyncio

from onepassword import Client  # Also import DesktopAuth for desktop app authentication.

async def main():
    # TODO: Initialize client using your preferred authentication method (see Overview > Get started)
    client = await Client.authenticate(...)

    # Your code here

asyncio.run(main())

See the examples folder in the 1Password Go, JavaScript, or Python SDK GitHub repository for full example code you can quickly clone and test in your project.

Grant vault permissions

Go
JavaScript
Python

Use the Vaults().GrantGroupPermissions() method to grant vault permissions to all team members who belong to a specific group. This method requires the following:

vaultID: The unique identifier of the vault.
A slice of one or more GroupAccess structs that each contain:
- GroupID: The unique identifier of the group.
- Permissions: A bitmask of vault permissions to grant to the group. You can combine multiple permissions using the bitwise OR operator (|).

// Grant group permissions to a vault.
groupAccess := onepassword.GroupAccess{
	GroupID:     groupID,
	Permissions: onepassword.ReadItems,
}
err := client.Vaults().GrantGroupPermissions(context.Background(), vaultID, []onepassword.GroupAccess{groupAccess})
if err != nil {
	panic(err)
}
fmt.Println("Granted group", groupID, "permissions to vault", vaultID)

Use the vaults.grantGroupPermissions() method to grant vault permissions to all team members who belong to a specific group. This method requires the following:

vaultId: The unique identifier of the vault.
An array of one or more GroupAccess objects that each contain:
- group_id: The unique identifier of the group.
- permissions: A bitmask of vault permissions to grant to the group. You can combine multiple permissions using the bitwise OR operator (|).

// Grant group permissions
await client.vaults.grantGroupPermissions(vaultId, [
  { groupId, permissions: sdk.READ_ITEMS },
]);
console.log(
  "Granted READ_ITEMS permissions to group",
  groupId,
  "on vault",
  vaultId,
);

Use the vaults.grant_group_permissions() method to grant vault permissions to all team members who belong to a specific group. This method requires the following:

vault_id: The unique identifier of the vault.
A list of one or more GroupAccess objects that each contains:
- group_id: The unique identifier of the group.
- permissions: A bitmask of vault permissions to grant to the group. You can combine multiple permissions using the bitwise OR operator (|).

The following example grants a group permission to read items in a vault.

from onepassword import GroupAccess, READ_ITEMS

vault_id = "your-vault-id"
group_id = "your-group-id"

# Grant group permissions in a vault
await client.vaults.grant_group_permissions(
    vault_id=vault_id,
    group_permissions_list=[
        GroupAccess(
            group_id=group_id,
            permissions=READ_ITEMS,
        )
    ],
)
print(f"Granted group {group_id} permissions to vault {vault_id}")

Update vault permissions

Make sure to specify all the permissions the group should have in the vault. This method completely replaces all existing permissions.

Go
JavaScript
Python

Use the Vaults().UpdateGroupPermissions() method to replace a group’s existing permissions in a vault. This method accepts a slice of one or more GroupVaultAccess structs that each contains:

VaultID: The unique identifier of the vault.
GroupID: The unique identifier of the group.
Permissions: A bitmask of the complete set of updated vault permissions. You can combine multiple permissions using the bitwise OR operator (|).

// Update group permissions for a vault
groupVaultAccess := onepassword.GroupVaultAccess{
	GroupID:     groupID,
	VaultID:     vaultID,
	Permissions: onepassword.ReadItems | onepassword.CreateItems | onepassword.UpdateItems,
}
err = client.Vaults().UpdateGroupPermissions(context.Background(), []onepassword.GroupVaultAccess{groupVaultAccess})
if err != nil {
	panic(err)
}
fmt.Println(
	"Updated group",
	groupID,
	"permissions to vault",
	vaultID,
)

Use the vaults.updateGroupPermissions() method to replace a group’s existing permissions in a vault. This method accepts an array of one or more GroupVaultAccess objects that each contains:

vaultID: The unique identifier of the vault.
groupID: The unique identifier of the group.
permissions: A bitmask of the complete set of updated vault permissions. You can combine multiple permissions using the bitwise OR operator (|).

// Update group permissions
await client.vaults.updateGroupPermissions([
  {
    vaultId,
    groupId,
    permissions: sdk.READ_ITEMS | sdk.CREATE_ITEMS | sdk.UPDATE_ITEMS,
  },
]);
console.log(
  "Updated group",
  groupId,
  "permissions to MANAGE_VAULT on vault",
  vaultId,
);

Use the vaults.update_group_permissions() method to replace a group’s existing permissions in a vault. This method accepts a list of one or more GroupVaultAccess objects that each contains:

vault_id: The unique identifier of the vault.
group_id: The unique identifier of the group.
permissions: A bitmask of the complete set of updated vault permissions. You can combine multiple permissions using the bitwise OR operator (|).

The following example updates a group’s permissions in a vault to give the group permission to read items, create items, and update items in the vault.The following example updates a group’s permissions in a vault to give the group permission to read items, create items, and update items in the vault.

from onepassword import CREATE_ITEMS, GroupVaultAccess, READ_ITEMS, UPDATE_ITEMS

vault_id = "your-vault-id"
group_id = "your-group-id"

# Update group permissions in a vault
await client.vaults.update_group_permissions(
    group_permissions_list=[
        GroupVaultAccess(
            vault_id=vault_id,
            group_id=group_id,
            permissions= READ_ITEMS | CREATE_ITEMS | UPDATE_ITEMS,
        )
    ],
)
print(f"Updated group {group_id} permissions to vault {vault_id}")

Revoke vault permissions

Go
JavaScript
Python

Use the Vaults().RevokeGroupPermissions() method to completely remove a group’s access to a vault. This method requires the following:

vaultID: The unique identifier of the vault.
groupID: The unique identifier of the group whose permissions you want to revoke.

// Revoke group permissions from a vault.
err = client.Vaults().RevokeGroupPermissions(context.Background(), vaultID, groupID)
if err != nil {
	panic(err)
}
fmt.Println("Revoked group permissions from vault", vaultID)

Use the vaults.revokeGroupPermissions() method to completely remove a group’s access to a vault. This method requires the following:

vaultID: The unique identifier of the vault.
groupID: The unique identifier of the group whose permissions you want to revoke.

// Revoke group permissions
await client.vaults.revokeGroupPermissions(vaultId, groupId);
console.log(
  "Revoked group",
  groupId,
  "permissions on vault",
  vaultId,
);

Use the vaults.revoke_group_permissions() method to completely remove a group’s access to a vault. This method requires the following:

vault_id: The unique identifier of the vault.
group_id: The unique identifier of the group whose permissions you want to revoke.

vault_id = "your-vault-id"
group_id = "your-group-id"

# Revoke a group's permissions in a vault
await client.vaults.revoke_group_permissions(
    vault_id=vault_id,
    group_id=group_id,
)
print(f"Revoked group {group_id}'s permissions in vault {vault_id}")

Appendix: Vault permissions

The permissions available to you depend on your account type: 1Password Business or 1Password Teams.

1Password Business vault permissions

In 1Password Business, all vault permissions have a hierarchical relationship in which narrower permissions require broader permissions to be granted alongside them. For example, to grant the narrower permission DELETE_ITEMS you must also grant the broader permissions EDIT_ITEMS, REVEAL_ITEM_PASSWORD, and READ_ITEMS. This is because you cannot delete items unless you can also view and edit them. Similarly, to revoke a broader permission like READ_ITEMS, any narrower dependent permissions like DELETE_ITEMS that have already been granted must also be revoked.

Permission	Description	Required dependencies	Integer
`READ_ITEMS`	View items in the vault.	None	32
`CREATE_ITEMS`	Create items in the vault.	`READ_ITEMS`	128
`REVEAL_ITEM_PASSWORD`	View and copy concealed password fields in the vault.	`READ_ITEMS`	16
`UPDATE_ITEMS`	Edit items in the vault.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`	64
`ARCHIVE_ITEMS`	Move items in the vault to the Archive.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`, `UPDATE_ITEMS`	256
`DELETE_ITEMS`	Delete items in the vault.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`, `UPDATE_ITEMS`	512
`UPDATE_ITEM_HISTORY`	View and restore item history.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`	1024
`IMPORT_ITEMS`	Move or copy items into the vault.	`READ_ITEMS`, `CREATE_ITEMS`	2097152
`EXPORT_ITEMS`	Save items in the vault to an unencrypted file that other apps can read.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`, `UPDATE_ITEM_HISTORY`	4194304
`SEND_ITEMS`	Copy and share items.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`, `UPDATE_ITEM_HISTORY`	1048576
`PRINT_ITEMS`	Print the contents of items in the vault.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`, `UPDATE_ITEM_HISTORY`	8388608
`MANAGE_VAULT`	Grant and revoke access to the vault, change permissions for others, and delete the vault. This permission doesn’t include any item viewing or editing permissions.	None	2
`NO_ACCESS`	Grants a group access entry to a vault without any permissions in it.		0

1Password Teams vault permissions

1Password Teams includes three broad permission levels made up of collections of the granular vault permissions available in 1Password Business. You’ll need to grant or revoke all the permissions for the desired permission level. The permission levels have a hierarchical relationship. To grant Allow editing, you must also grant the permissions included in Allow viewing.

Permission	Description	Includes permissions
Allow viewing	View items in a vault, view concealed passwords and copy them to the clipboard.	`READ_ITEMS`, `REVEAL_ITEM_PASSWORD`, `UPDATE_ITEM_HISTORY`
Allow editing	Create, edit, move, print, copy, archive, and delete items in the vault. Requires the `Allow viewing` permission level to be granted.	`CREATE_ITEMS`, `UPDATE_ITEMS`, `ARCHIVE_ITEMS`, `DELETE_ITEMS`, `IMPORT_ITEMS`, `EXPORT_ITEMS`, `SEND_ITEMS`, `PRINT_ITEMS`
Allow managing	Grant and revoke access to the vault, change permissions for others, and delete the vault.	`MANAGE_VAULT`

​Before you get started

​Grant vault permissions

​Update vault permissions

​Revoke vault permissions

​Appendix: Vault permissions

​1Password Business vault permissions

​1Password Teams vault permissions

Before you get started

Grant vault permissions

Update vault permissions

Revoke vault permissions

Appendix: Vault permissions

1Password Business vault permissions

1Password Teams vault permissions