Device

Action	Sample	Rule
Device (catch-all)	N	N
Add Device	Y	N
Delete Device	N	N
Reauthorize Device	Y	N
Update Device	N	N

any: Device (catch-all)

Description

Matches any device event.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

device-create: Add Device

Description

A device was added to the account.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "XBYM3K4CNE43K47UROZOVSLA5C",
  "timestamp": "12/15/2023, 10:08:15.558 AM",
  "location": {
    "country": "The Netherlands",
    "region": "North Holland",
    "city": "Amsterdam",
    "latitude": 52.3759,
    "longitude": 4.8975
  },
  "actor_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "actor_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "action": "create",
  "object_type": "device",
  "object_uuid": "wnxznnlchyi4cpqratg6dzigjq",
  "aux_id": "11829892",
  "aux_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "aux_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "session": {
    "uuid": "LYLWMPH245GGLEE5T5GULX7FRU",
    "login_time": "2023-12-15T10:08:15.5397096Z",
    "device_uuid": "wnxznnlchyi4cpqratg6dzigjq",
    "ip": "193.187.128.72"
  }
}

References #

device-delete: Delete Device

Description

A device was deleted.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

device-reauth: Reauthorize Device

Description

A deauthorized device was reauthorized.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "aux_id": "19041431",
  "uuid": "DUMMY-ID-0031",
  "action": "reauth",
  "session": {
    "uuid": "DUMMY-ID-0032",
    "login_time": "2026-06-23T15:38:59.583286384Z",
    "device_uuid": "DUMMY-ID-0033",
    "ip": "2001:db8::9"
  },
  "aux_uuid": "DUMMY-USER-0012",
  "location": {
    "country": "Dummy Country 004",
    "region": "Dummy Region 004",
    "city": "Dummy City 007",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "timestamp": "2026-06-23T15:39:01.185744116Z",
  "actor_type": "user",
  "actor_uuid": "DUMMY-USER-0012",
  "aux_details": {
    "uuid": "DUMMY-USER-0012",
    "name": "Dummy User 012",
    "email": "dummy.user012@example.invalid"
  },
  "object_type": "device",
  "object_uuid": "DUMMY-ID-0034",
  "account_uuid": "DUMMY-ID-0004",
  "actor_details": {
    "uuid": "DUMMY-USER-0012",
    "name": "Dummy User 012",
    "email": "dummy.user012@example.invalid"
  }
}

References #

device-update: Update Device

Description

A device was updated.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.