1Password Events API MCP integration for AI agents.
Connect AI agents to 1Password Events API through 3 structured actions, including list audit events, list item usages, and list sign in attempts. Review auth…
- ACTION CONTRACTS
- 3
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the 1Password Events API integration exposes
The 1Password Events API Agent App exposes 3 provider-backed actions for security work. Its current contract lets an authorized agent list 1password audit events using the official cursor-based events api, list 1password item usage events using the official cursor-based events api, and list 1password sign-in attempts using the official cursor-based events api. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected 1Password Events API account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real 1Password Events API capabilities.
Showing 3 of 3 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
list_audit_eventsREADList 1Password audit events using the official cursor-based Events API.
INPUTS: cursor / startTime / endTime / limit
list_item_usagesREADList 1Password item usage events using the official cursor-based Events API.
INPUTS: cursor / startTime / endTime / limit
list_sign_in_attemptsREADList 1Password sign-in attempts using the official cursor-based Events API.
INPUTS: cursor / startTime / endTime / limit
INPUT CONTRACTS
Know what the action needs before it runs.
list_audit_events
cursorOPTIONAL- Cursor from a previous 1Password Events API response.
startTimeOPTIONAL- Start time for a reset cursor request.
endTimeOPTIONAL- End time for a reset cursor request.
limitOPTIONAL- Maximum number of events to return, from 1 to 1000.
list_item_usages
cursorOPTIONAL- Cursor from a previous 1Password Events API response.
startTimeOPTIONAL- Start time for a reset cursor request.
endTimeOPTIONAL- End time for a reset cursor request.
limitOPTIONAL- Maximum number of events to return, from 1 to 1000.
list_sign_in_attempts
cursorOPTIONAL- Cursor from a previous 1Password Events API response.
startTimeOPTIONAL- Start time for a reset cursor request.
endTimeOPTIONAL- End time for a reset cursor request.
limitOPTIONAL- Maximum number of events to return, from 1 to 1000.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect List Audit Events
List 1Password audit events using the official cursor-based Events API. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
list_audit_eventsVerify with List Item Usages
List 1Password item usage events using the official cursor-based Events API. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
list_item_usagesSAFETY BOUNDARY
Operate 1Password Events API with explicit limits
- Authorize 1Password Events API with API key and grant only the provider access required by the selected actions.
- The current action names appear read-oriented, but returned 1Password Events API data may still be sensitive and should be minimized before it enters model context.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- The sampled contract declares provider scopes including `auditevents`, `itemusages`, and `signinattempts`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the 1Password Events API task completed successfully.
CONNECTION MODEL
API key
1Password Events Reporting bearer token sent with the Authorization: Bearer header. Create an Events Reporting integration in 1Password and copy its bearer token.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 3
- WRITE SIGNALS
- 0
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 0
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by 1Password Events API.