1Password Audit Events API

openapi: 3.1.0
info:
  title: 1Password Connect Server Accounts Audit Events API
  description: The 1Password Connect Server API provides secure access to 1Password items and vaults in your company's apps and cloud infrastructure through a private REST API. Connect Servers bridge the gap between 1Password and your infrastructure by enabling programmatic access to secrets stored in shared vaults. You can create, read, update, and delete items, manage vaults, and retrieve files attached to items.
  version: 1.8.1
  contact:
    name: 1Password Support
    url: https://support.1password.com/
  termsOfService: https://1password.com/legal/terms-of-service/
  license:
    name: MIT
    url: https://github.com/1Password/connect/blob/main/LICENSE
servers:
- url: http://localhost:8080
  description: Local Connect Server (default port 8080)
security:
- bearerAuth: []
tags:
- name: Audit Events
  description: Retrieve information about actions performed by team members within a 1Password account, including when an action was performed and by whom, along with details about the type and object of the action.
paths:
  /api/v2/auditevents:
    post:
      operationId: listAuditEventsV2
      summary: 1Password List Audit Events
      description: Returns information about actions performed by team members within a 1Password account. Each record includes when an action was performed and by whom, along with details about the type and object of the action. The request must include either a cursor from a previous response or a ResetCursor object with a start time.
      tags:
      - Audit Events
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EventRequest'
      responses:
        '200':
          description: Successfully retrieved audit events
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    AuditEventResponse:
      type: object
      description: The response containing audit event records and a cursor for pagination.
      properties:
        cursor:
          type: string
          description: A cursor to use in the next request to continue fetching events.
        has_more:
          type: boolean
          description: Whether there are more events available to fetch using the cursor.
        items:
          type: array
          description: The list of audit event records.
          items:
            $ref: '#/components/schemas/AuditEvent'
    Error:
      type: object
      description: Represents an error response from the Events API.
      properties:
        status:
          type: integer
          description: The HTTP status code.
        message:
          type: string
          description: A human-readable error message.
    AuditEvent:
      type: object
      description: Represents an audit event recording an action performed by a team member within the 1Password account.
      properties:
        uuid:
          type: string
          format: uuid
          description: The unique identifier for the audit event.
        timestamp:
          type: string
          format: date-time
          description: When the action was performed.
        actor_uuid:
          type: string
          format: uuid
          description: The UUID of the user who performed the action.
        actor_details:
          $ref: '#/components/schemas/EventUser'
        action:
          type: string
          description: The type of action that was performed.
        object_type:
          type: string
          description: The type of object the action was performed on.
        object_uuid:
          type: string
          format: uuid
          description: The UUID of the object the action was performed on.
        object_details:
          type: object
          description: Additional details about the object of the action.
        aux_id:
          type: integer
          description: An auxiliary identifier providing additional context.
        aux_uuid:
          type: string
          format: uuid
          description: An auxiliary UUID providing additional context.
        aux_details:
          type: object
          description: Additional auxiliary details about the event.
        aux_info:
          type: string
          description: Additional auxiliary information about the event.
        session:
          type: object
          description: Information about the session in which the action occurred.
          properties:
            uuid:
              type: string
              format: uuid
              description: The UUID of the session.
            login_time:
              type: string
              format: date-time
              description: When the session was created.
            device_uuid:
              type: string
              format: uuid
              description: The UUID of the device used.
            ip:
              type: string
              description: The IP address of the client.
        location:
          $ref: '#/components/schemas/EventLocation'
    EventRequest:
      type: object
      description: The request body for fetching events. Must include either a cursor string from a previous response to continue pagination, or a ResetCursor object to start fetching from a specific time.
      properties:
        limit:
          type: integer
          description: The maximum number of event records to return per page.
          minimum: 1
          maximum: 1000
          default: 100
        cursor:
          type: string
          description: A cursor from a previous response to continue fetching events from where the last request left off.
        start_time:
          type: string
          format: date-time
          description: An ISO 8601 timestamp to begin fetching events from a specific time. Used to create a new cursor starting from this point.
    EventUser:
      type: object
      description: Represents a user involved in an event.
      properties:
        uuid:
          type: string
          format: uuid
          description: The unique identifier of the user.
        name:
          type: string
          description: The name of the user.
        email:
          type: string
          format: email
          description: The email address of the user.
    EventLocation:
      type: object
      description: Geographic location information associated with an event.
      properties:
        country:
          type: string
          description: The two-letter ISO country code.
          minLength: 2
          maxLength: 2
        region:
          type: string
          description: The region or state.
        city:
          type: string
          description: The city name.
        latitude:
          type: number
          format: double
          description: The latitude coordinate.
        longitude:
          type: number
          format: double
          description: The longitude coordinate.
  responses:
    Unauthorized:
      description: Authentication credentials are missing or invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    TooManyRequests:
      description: Rate limit exceeded
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: A Connect server access token generated from 1Password. Each request must include this token in the Authorization header.
externalDocs:
  description: 1Password Connect Server API Reference
  url: https://developer.1password.com/docs/connect/api-reference/