# Sign In Attempts

Retrieves 1Password sign in attempts for activity monitoring.

**Sync Type: Full Synchronisation**


## Requirements
- Before you connect Monad to 1Password, you need admin access to a 1Password account, and an appropriate plan that supports audit log access. 
- Once you have access, you need to create a Bearer token following these steps: https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens. Ensure ***auditevents*** permissions on the token. This token is long lived.
- Once done, you need to figure out your Base URL for your account for Monad to connect to. Find more info about the same here: https://developer.1password.com/docs/events-api/servers/

## Details
Monad uses the `timestamp` as a part of the query parameters on the [API](https://developer.1password.com/docs/events-api/reference/#post-apiv2signinattempts) to determine what events to display. This field is updated every time a request to get events is successful with the time of the latest event generated. If this was the first time requesting for events, a full sync of the data is performed.

## Configuration
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Base URL | string | No | The base URL for your 1Password account. |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Bearer Token | string | Yes | Bearer token for 1Password API. This is required to authenticate requests. |

## Related Articles

- [https://developer.1password.com/docs/events-api/reference/#post-apiv2signinattempts](https://developer.1password.com/docs/events-api/reference/#post-apiv2signinattempts)

## Sample Record

```json
{
  "account_uuid": "c765278f-bdc6-f88e-4b4b-a00923a8a194",
  "category": "warning",
  "client": {
    "app_name": "1Password Browser",
    "app_version": "8795762",
    "ip_address": "105.238.214.162",
    "os_name": "Darwin",
    "os_version": "14",
    "platform_name": "onepassword-connect-68568c988d-kshjb",
    "platform_version": "x86_64"
  },
  "country": "US",
  "details": null,
  "location": {
    "city": "Boardman",
    "country": "GB",
    "latitude": -90,
    "longitude": 180,
    "region": "Washington"
  },
  "session_uuid": "8e01f042-713c-11bd-d99e-08f233c16e13",
  "target_user": {
    "email": "bob.williams@example.com",
    "name": "testing",
    "type": "service",
    "uuid": "2236d1c9-ab82-b49c-f293-d454931a6a7e"
  },
  "timestamp": "2025-10-22T19:57:45.332155Z",
  "type": "credentials_failed",
  "uuid": "e0c53c5e-d44b-57aa-a879-be9ac2f3b6f1"
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.