1Password Integration

Overview

The 1Password integration connects your 1Password account to Fencer for identity management and security event monitoring. Once connected, Fencer continuously ingests audit events, item usage events, and sign-in attempt events from the 1Password Events API and makes them available to detection rules and threat hunting. It also syncs user identities from 1Password into Fencer’s identity management system, automatically detecting service accounts.

Prerequisites

An active Fencer organization with a valid subscription.
The Administrator role in the Fencer organization.
A plan that includes Security Monitoring. Without it, the 1Password card on Admin > Integrations shows Upgrade instead of opening the connect flow.
A 1Password account with access to the Events API.
A bearer token with access to audit events, item usages, and sign-in attempts.

How it works

Fencer connects to the 1Password Events API using a bearer token scoped to your account. During setup, Fencer validates the token by calling the introspection endpoint and verifying that the required event features (auditevents, itemusages, signinattempts) are available.

Once connected, Fencer polls the Events API for each event type every two minutes and feeds the events into Security Monitoring, where they are available to detection rules and threat hunting. Each poll overlaps the previous one by a few seconds, so no events are missed between polls. Polling is skipped while the connection is unhealthy or your plan is inactive.

For identity management, Fencer derives user identities from audit event data from the last 120 days. It extracts unique users, tracks their last activity time and location, takes each user’s state from their latest suspend, reactivate, or delete event, and automatically classifies accounts as service accounts when they match known patterns (e.g., emails ending in @1passwordserviceaccounts.com, or names/emails with prefixes like svc- or bot-).

Usage / Configuration

Generating a 1Password Events API token

You must be a 1Password account administrator (or have permission to create integrations and manage API tokens).

Sign in to your 1Password account. Note your domain (e.g., your-domain.1password.com).
Navigate to Integrations and open the Directory. Under Events Reporting, click Other to open the Events Reporting wizard.
Set the System name to Fencer and click Add Integration.
Set the Token Name (for example, Fencer SIEM), choose an expiration date, and grant access to all three event types: Audit events, Item usage, and Sign-in attempts.
Copy the generated bearer token.

Connecting 1Password

Go to Admin > Integrations.
Under Available Integrations, click the 1Password card, then click Continue.
Fill in the connection form:
- Name (optional) — a friendly label for this connection. Defaults to the domain if left blank.
- 1Password domain — your unique 1Password domain (e.g., your-domain.1password.com). You can paste the full URL; Fencer extracts the hostname automatically.
- Bearer access token — the token you generated in the previous step.
Click Connect. Fencer validates the token against the 1Password introspection API and checks that all required permissions are present.
On success, the integration appears under Active Integrations and an identity sync starts automatically.

Editing a connection

Go to Admin > Integrations.
Click Edit on the 1Password integration card.
Update the name, domain, or access token as needed. Leave the token blank to keep the stored one; a new token is validated again before it is saved.
Click Save changes.

Disconnecting 1Password

Go to Admin > Integrations.
Click Remove on the 1Password integration card and confirm with Remove.
Fencer clears the stored access token and soft-deletes the connection. Event ingestion stops.

Examples

Event types ingested

Fencer ingests three categories of events from 1Password:

Audit events — track actions performed on account objects such as vaults, items, users, groups, and policies. Each event includes the actor, action (e.g., create, delete, update), target object, and geolocation data.
Item usage events — record when vault items are accessed, for example fill (autofill in the browser) or reveal (showing a password). Each event includes the user, vault, item, and client application details.
Sign-in attempt events — capture both successful and failed authentication attempts. Categories include success, credentials_failed, mfa_failed, sso_failed, and firewall_failed. Each event includes the target user, client details, and country of origin.

These events are available to detection rules in Security Monitoring and in Operations > Threat Hunting for ad-hoc investigation.

Identity sync

After connecting 1Password, Fencer syncs user identities from audit events in the last 120 days. Each unique user becomes a vendor identity in Fencer’s identity management system. The sync captures:

Display name and email address
Last activity timestamp and geographic location
Status (active or suspended; users whose latest event is a deletion are left out)
Identity type classification (user or service account)

Troubleshooting

“Unable to connect your 1Password account. Please check your API access token.” — the bearer token is invalid or expired. Generate a new token in 1Password and update the connection.
“Your 1Password access token is missing required permissions: …” — the token does not have access to all three event types. Ensure the token was created with access to audit events, item usages, and sign-in attempts.
Events not appearing — verify the connection status is healthy on Admin > Integrations. Fencer polls every two minutes and skips unhealthy connections, so new events may take a few minutes to appear.
Identity sync shows fewer users than expected — Fencer derives identities from audit events over the last 120 days. Users who have not triggered any audit events in that window will not appear.