OnePassword Tables

The OnePassword integration includes the following tables

Tables

Roster of users in the 1Password Business account synced from the Users API for Partners.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
ID	string	1Password user UUID from the Users API (`id field`). Natural key within an account.
DisplayName	string	Display name of the user.
Email	string	Email address of the user.
State	string	Account-level state of the user. Expected values: `STATE_UNSPECIFIED`, `ACTIVE`, `SUSPENDED`.
CreateTime	datetime	Date and time when the user was created in 1Password (`RFC 3339`).
Path	string	Resource path of the user in the form `accounts/{account_id}/users/USER_ID`.
BatchDate	datetime	Date and time when this data snapshot was ingested into Compyl.

Administrative actions performed by team members in the 1Password Business account.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
UUID	string	Unique identifier for the audit event.
Timestamp	datetime	Date and time when the action was performed (`RFC 3339`).
Action	string	Type of action performed. Example values: `create`, `update`, `delete`, `activate`, `suspend`, `reactive`, `grant`, `revoke`, `share`, `view`, `export`, `join`, `leave`.
ObjectType	string	Type of object the action was performed on. Example values: `user`, `vault`, `item`, `group`, `account`, `device`, `invite`, `report`.
ObjectUUID	string	Unique identifier for the object the action was performed on.
AccountUUID	string	UUID of the 1Password account where the action was performed.
AuxID	integer	Numeric auxiliary identifier providing additional information about the activity (for example a device ID that was added or removed).
AuxUUID	string	Auxiliary UUID providing additional information about the activity (for example a team member UUID joining or leaving a group).
AuxInfo	string	Freeform additional information about the activity.
ActorUUID	string	UUID of the user who performed the action.
ActorName	string	Name of the user who performed the action.

Item access events (fill, reveal, copy, export, share) for items stored in shared 1Password vaults.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
UUID	string	Unique identifier for the item-usage event.
Timestamp	datetime	Date and time when the item was accessed (`RFC 3339`).
UsedVersion	integer	Version of the item that was accessed.
VaultUUID	string	UUID of the vault the accessed item belongs to.
ItemUUID	string	UUID of the item that was accessed.
Action	string	How the item was used. Example values: `fill`, `reveal`, `secure-copy`, `export`, `share`. Reported by 1Password 8.4.0 and newer clients.
AccountUUID	string	MSP-only. UUID of the account where the action was performed.
UserUUID	string	UUID of the user who accessed the item.
UserName	string	Name of the user who accessed the item.
UserEmail	string	Email address of the user who accessed the item.
UserType	string	MSP-only. Type of user who accessed the item. Values: `user`, `external_user`.

Sign-in attempts against the 1Password Business account, including successful and failed sign-ins.

Name	Type	Description
ConfigID	integer	Internal Compyl configuration ID for this tenant.
UUID	string	Unique identifier for the sign-in attempt event.
SessionUUID	string	UUID of the session that produced the sign-in attempt.
Timestamp	datetime	Date and time when the sign-in attempt occurred (`RFC 3339`).
Category	string	Sign-in attempt outcome category. Values: `success`, `credentials_failed`, `mfa_failed`, `sso_failed`, `firewall_failed`, `modern_version_failed`, `firewall_reported_success`.
Type	string	Detailed reason or type for the sign-in attempt outcome. Example values: `credentials_ok`, `mfa_ok`, `password_secret_bad`, `mfa_missing`, `okta_reauth_failed`, `ip_blocked`, `continent_blocked`, `country_blocked`.
Country	string	ISO 3166 country code captured for the event.
AccountUUID	string	MSP-only. UUID of the account where the attempt occurred.
DetailsValue	string	Freeform additional detail from the sign-in attempt (for example the reason for a blocked attempt).
TargetUserUUID	string	UUID of the user being signed in.
TargetUserName	string	Name of the user being signed in.
TargetUserEmail	string	Email address of the user being signed in.

Updated 6 months ago

Did this page help you?