# Audit Events

Retrieves 1Password audit events for activity monitoring.

**Sync Type: Full Synchronisation**


## Requirements
- Before you connect Monad to 1Password, you need admin access to a 1Password account, and an appropriate plan that supports audit log access. 
- Once you have access, you need to create a Bearer token following these steps: https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens. Ensure ***auditevents*** permissions on the token. This token is long lived.
- Once done, you need to figure out your Base URL for your account for Monad to connect to. Find more info about the same here: https://developer.1password.com/docs/events-api/servers/

## Details
Monad uses the `timestamp` as a part of the query parameters on the [API](https://developer.1password.com/docs/events-api/reference/#post-apiv2auditevents) to determine what events to display. This field is updated every time a request to get events is successful with the time of the latest event generated. If this was the first time requesting for events, a full sync of the data is performed.

## Configuration
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Base URL | string | No | The base URL for your 1Password account. |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Bearer Token | string | Yes | Bearer token for 1Password API. This is required to authenticate requests. |

## Related Articles

- [https://developer.1password.com/docs/events-api/reference/#post-apiv2auditevents](https://developer.1password.com/docs/events-api/reference/#post-apiv2auditevents)

## Sample Record

```json
{
  "account_uuid": "131fe3d6-9f11-7c3c-088d-cc34d636de9a",
  "action": "dlgsess",
  "actor_details": {
    "email": "alice.johnson@example.com",
    "name": "Jane Brown",
    "uuid": "62f10fd4-38d3-bb10-ac52-25978d6fcdfe"
  },
  "actor_type": "api",
  "actor_uuid": "9ee1e771-5095-9a84-4d24-09d18975c57d",
  "aux_uuid": "e8715b82-f422-0ecb-80e0-8dcecfb173ab",
  "location": {
    "city": "Austin",
    "country": "United Kingdom",
    "latitude": 90,
    "longitude": -180,
    "region": "New York"
  },
  "object_type": "dlgdsess",
  "object_uuid": "033be4b8-e395-1e97-e885-4980161c00e4",
  "session": {
    "device_uuid": "bf1b89c9-9507-b2de-2c50-6df92b279732",
    "ip": "68.95.92.231",
    "login_time": "2025-10-22T19:55:33.248183Z",
    "uuid": "64e730fc-2644-2093-e836-7a74f28a07d2"
  },
  "timestamp": "2025-10-22T19:55:33.248218Z",
  "uuid": "a2070a88-5231-37c4-5d39-8dbf7ef47188"
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.