{
  "slug": "1password",
  "name": "1Password",
  "description": "Monitor 1Password audit events, vault access, and sign-in activity for secrets management compliance. Requires a 1Password Business plan.",
  "category": "Security",
  "docsUrl": "https://developer.1password.com/docs/events-api/",
  "baseUrl": "https://events.1password.com/",
  "authConfig": {
    "type": "custom",
    "config": {
      "setupInstructions": "Requires: 1Password Business plan (not available on Teams or Teams Starter Pack).\n\n1. Sign in to 1Password.com as an owner or admin\n2. Go to Integrations > Events Reporting\n3. Click New Integration > select Other\n4. Enable scopes: Sign-in attempts, Item usages, Audit events\n5. Copy the generated token\n6. Enter your region: com (US), eu (Europe), or ca (Canada)\n7. Paste the token below\n\nNote: Do NOT use a Service Account token — Events Reporting tokens are required.",
      "credentialFields": [
        {
          "label": "Events API Token",
          "type": "password",
          "required": true,
          "helpText": "Create an Events Reporting integration at 1Password.com > Integrations > Events Reporting. Enable scopes: Sign-in attempts, Item usages, Audit events."
        },
        {
          "label": "Region",
          "type": "text",
          "required": true,
          "helpText": "Enter your account region: com (US), eu (Europe), or ca (Canada)"
        }
      ]
    }
  },
  "capabilities": [
    "checks"
  ],
  "supportsMultipleConnections": false,
  "syncSupported": false,
  "checks": [
    {
      "slug": "onepassword_audit_logging",
      "name": "Secure Secrets",
      "description": "Verifies 1Password audit logging is enabled and the Events API token has access to audit events",
      "defaultSeverity": "high",
      "enabled": true
    },
    {
      "slug": "onepassword_signin_attempts",
      "name": "Employee Access",
      "description": "Reviews recent 1Password sign-in attempts via the Events API and surfaces aggregate evidence (success/failure counts, unique users, unique IPs, latest sign-in). Fails if the Events Reporting token is missing the \"signinattempts\" scope or no sign-ins are returned.",
      "defaultSeverity": "high",
      "enabled": true
    }
  ],
  "checkCount": 2,
  "isActive": true
}