---
title: "1Password"
slug: "1password"
tags: ["Self Service Ingestion"]
updated: 2026-02-01T08:56:23Z
published: 2026-02-01T08:56:23Z
canonical: "docs.hunters.ai/1password"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

[Embedded content](https://docs.google.com/spreadsheets/d/e/2PACX-1vSUe_4noB0EV7RrrDfOYRGAuP3BzQ48lcrX0hu4gBpuSAarf8qSUJNSdmOgNuXwDV8IhneTCCvUea6t/pubhtml?gid=581914051&single=true&widget=true&headers=false&chrome=false)

---

## Overview

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/93746eb-1password(3).png)1Password is a password manager that stores encrypted passwords online. In the process of integrating the logs into hunters, the data is fetched using API, normalized into schemas and streamed to Hunters' Data Lake. The Ingestion allows the exploration of this source for overseeing users' sign in attempts and item usages.

## Supported data types

****Sign In Attempts****

**Table name:** `onepassword_sign_in_logs`

Returns information about sign-in attempts. Events include the name and IP address of the user who attempted to sign in to the account, when the attempt was made, and -- for failed attempts -- the cause of the failure. More information on the event types can be found [here](https://developer.1password.com/docs/events-api/reference/#introspection).

**Expected format**

Logs are expected in Json format.

```plaintext
{"category":"success","client":{"app_name":"1Password for Web","app_version":"2171","ip_address":"1.1.1.1","os_name":"MacOSX","os_version":"26.2.0","platform_name":"Chrome","platform_version":"144.0.7559.97"},"country":"Country_Redacted","details":null,"location":{"city":"City_Redacted","country":"Country_Redacted","latitude":0.0000,"longitude":0.0000,"region":"Region_Redacted"},"session_uuid":"session_uuid_redacted_1","target_user":{"email":"user3@example.com","name":"User Three","uuid":"target_user_uuid_redacted_1"},"timestamp":"2026-01-27T14:53:16.803613331Z","type":"credentials_ok","uuid":"event_uuid_redacted_3"}
```

****Item Usages****

**Table name:** `onepassword_item_usages_logs`

Returns information about items in shared vaults that have been modified, accessed, or used. Events include the name and IP address of the user who accessed the item, when it was accessed, and the vault where the item is stored. More information on the event types can be found [here](https://developer.1password.com/docs/events-api/reference/#introspection).

**Expected format**

Logs are expected in Json format.

```plaintext
{"action":"share","client":{"app_name":"1Password for Web","app_version":"2171","ip_address":"1.1.1.1","os_name":"MacOSX","os_version":"26.2.0","platform_name":"Chrome","platform_version":"144.0.7559.97"},"item_uuid":"item_uuid_redacted_1","location":{"city":"City_Redacted","country":"Country_Redacted","latitude":0.0000,"longitude":0.0000,"region":"Region_Redacted"},"timestamp":"2026-01-27T14:41:29.770358065Z","used_version":2,"user":{"email":"user1@example.com","name":"User One","uuid":"user_uuid_redacted_1"},"uuid":"event_uuid_redacted_1","vault_uuid":"vault_uuid_redacted_1"}
{"action":"fill","client":{"app_name":"1Password Browser Extension","app_version":"1234","ip_address":"1.1.1.1","os_name":"MacOSX","os_version":"26.2.0","platform_name":"Chrome extension","platform_version":"144.0.7559.97"},"item_uuid":"item_uuid_redacted_2","location":{"city":"City_Redacted","country":"Country_Redacted","latitude":0.0000,"longitude":0.0000,"region":"Region_Redacted"},"timestamp":"2026-01-27T14:29:02.793Z","used_version":1,"user":{"email":"user2@example.com","name":"User Two","uuid":"user_uuid_redacted_2"},"uuid":"event_uuid_redacted_2","vault_uuid":"vault_uuid_redacted_2"}
```

****Audit Events****

**Table name:** `onepassword_audit_events`

Returns audit events from the Activity Log of your 1Password Business account. Audit event data includes actions performed by team members in a 1Password account, such as changes made to the account, vaults, groups, users, and more. More information on the event types can be found [here](https://developer.1password.com/docs/events-api/audit-events/).

**Expected format**

Logs are expected in Json format.

```plaintext
{"action":"ssotknv","actor_details":{"email":"user3@example.com","name":"User Three","uuid":"target_user_uuid_redacted_1"},"actor_uuid":"target_user_uuid_redacted_1","aux_info":"{\"expiry\":\"2026-01-27T15:03:16Z\",\"deviceUuid\":\"device_uuid_redacted_1\"}","location":{"city":"City_Redacted","country":"Country_Redacted","latitude":0.0000,"longitude":0.0000,"region":"Region_Redacted"},"object_type":"ssotkn","object_uuid":"object_uuid_redacted_1","session":{"device_uuid":"device_uuid_redacted_1","ip":"192.0.2.50","login_time":"2026-01-27T14:53:16.78511298Z","uuid":"session_uuid_redacted_1"},"timestamp":"2026-01-27T14:53:16.798211108Z","uuid":"event_uuid_redacted_5"}
```

## Send data to Hunters

Hunters supports the collection of 1Password logs using API.

**To connect 1Password logs:**

1. Acquire the **Host** value from 1Password as described [here](https://developer.1password.com/docs/events-api/reference/#servers).
  1. it should be something like `https://events.1password.eu` or `https://events.1password.us` (with the `https://` inserted by you to the box): ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(298).png)
2. Acquire the **Bearer Token** value from 1Password as described [here](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens).

> [!NOTE]
> 📘Note
> 
> To enable each of the supported data types, a relevant Scope needs to be added to the Bearer Token upon creation. Make sure to add the relevant scopes with respect to the data that needs to be onboarded.
3. Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source).