Integration

1Password Events API integration

The 1Password Events API reports activity in a 1Password Business account, for security monitoring and SIEM pipelines. Read audit events (actions team members performed on users, vaults, groups, items and account settings), item usage events (items in shared vaults that were filled, revealed, copied, edited or shared) and sign-in attempts (successful and failed, with the failure cause), each page with a cursor to resume from, and check which of the three event feeds a token can read. The version 1 routes, the deprecated unversioned introspection route and the v3 beta audit events route are not exposed. Authentication is a bearer token issued by an Events Reporting integration in the 1Password account; domain is the server the account is hosted on: 1password.com, ent.1password.com, 1password.ca or 1password.eu.

Connect 1Password Events API How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in 1Password Events API.Built from the 4 1Password Events API tools below, on the connection you add once.

What you can do with 1Password Events API

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Audit event, 1 operation

list_audit_eventsList audit eventsPOSTReturns a page of audit events: actions team members performed in the account, with who, what action, on which object, session and location. Start with limit or start_time, then send the returned cursor for the next page.

Item usage, 1 operation

list_item_usagesList item usagesPOSTReturns a page of item usage events: items in shared vaults that were filled, revealed, copied, edited or shared, with the user, app and location. Start with limit or start_time, then send the returned cursor for the next page.

Sign in attempt, 1 operation

list_sign_in_attemptsList sign in attemptsPOSTReturns a page of sign-in attempts, successful and failed, with category and type (the failure cause), the user, app, country and location. Start with limit or start_time, then send the returned cursor for the next page.

Token, 1 operation

introspect_tokenIntrospect tokenGETChecks the bearer token: returns the UUID of its Events Reporting integration, when it was issued, the account UUID, and which event feeds it can read (auditevents, itemusages, signinattempts).

Use 1Password Events API from Claude Code, Cursor or Codex

Connect 1Password Events API in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its 1Password Events API operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect 1Password Events API

Create your workspace
Sign up free. Nothing to install.
Connect 1Password Events API once
Add your 1Password Events API connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.