Items

Action	Sample	Rule
Items (catch-all)	N	N
Delete Trashed Vault Items	N	N
Patch Vault Items	Y	N
Purge Deleted Vault Items	Y	N

any: Items (catch-all)

Description

Matches any items event.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

items-delete: Delete Trashed Vault Items

Description

Vault items in the trash were deleted.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

items-patch: Patch Vault Items

Description

Vault items were added or updated.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "patch",
  "actor_details": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "actor_type": "user",
  "actor_uuid": "opid-adc712a95a826da15eac",
  "aux_id": 0,
  "aux_info": "REDACTED",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "object_type": "items",
  "object_uuid": "opid-4f273719af40edb843de",
  "session": {
    "device_uuid": "opid-517df91906f62a8bf419",
    "ip": "203.0.113.16",
    "login_time": "2026-08-24T00:44:54.720872837Z",
    "uuid": "opid-4f31aa5206aa645ce7e4"
  },
  "timestamp": "2026-08-24T00:44:58.075401898Z",
  "uuid": "opid-22d1e1cdcf124209ed3d"
}

References #

items-purge: Purge Deleted Vault Items

Description

Deleted vault items were marked to be purged.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "uuid": "DUMMY-ID-0043",
  "action": "purge",
  "session": {
    "uuid": "DUMMY-ID-0044",
    "login_time": "2026-08-04T19:03:45.734728647Z",
    "device_uuid": "DUMMY-ID-0045",
    "ip": "192.0.2.11"
  },
  "aux_info": "1",
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 005",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "timestamp": "2026-08-04T20:13:47.648201667Z",
  "actor_type": "user",
  "actor_uuid": "DUMMY-USER-0016",
  "object_type": "items",
  "object_uuid": "DUMMY-ID-0046",
  "account_uuid": "DUMMY-ID-0004",
  "actor_details": {
    "uuid": "DUMMY-USER-0016",
    "name": "Dummy User 016",
    "email": "dummy.user016@example.invalid"
  }
}