---
title: 1Password connector
description: The 1Password connector uses the 1Password Users API to manage users in a 1Password Enterprise Password Manager account. It enables security teams to...
url: https://www.elastic.co/docs/reference/kibana/connectors-kibana/one-password-action-type
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview since 9.4
---

# 1Password connector
The 1Password connector uses the [1Password Users API](https://developer.1password.com) to manage users in a 1Password Enterprise Password Manager account. It enables security teams to automate identity-level response actions — such as suspending compromised users — directly from Elastic Security workflows.

## Create connectors in Kibana

You can create connectors in **Stack Management > Connectors**. For example:

### Connector configuration

1Password connectors have the following configuration properties:
<definitions>
  <definition term="Account UUID">
    The UUID of your 1Password account. You can find this in the 1Password admin console.
  </definition>
  <definition term="Client ID">
    The OAuth 2.0 Client ID for your 1Password integration.
  </definition>
  <definition term="Client Secret">
    The OAuth 2.0 Client Secret for your 1Password integration.
  </definition>
</definitions>

The connector authenticates using the OAuth 2.0 Client Credentials flow with `client_secret_basic` authentication. The token URL and scope are derived automatically.

## Test connectors

You can test connectors as you're creating or editing the connector in Kibana.
The 1Password connector has the following actions:
<definitions>
  <definition term="List Users">
    List users in the 1Password account, optionally filtered by state.
    - **filter** (optional): Filter expression — `user.isActive()` or `user.isSuspended()`. Omit to return all users.
    - **maxPageSize** (optional): Maximum number of users to return in a single response, from 1 to 1000. Defaults to 25.
    - **pageToken** (optional): Token to fetch the next page of results.
  </definition>
  <definition term="Get User">
    Retrieve details for a single user by their UUID.
    - **uuid** (required): The UUID of the user.
  </definition>
  <definition term="Suspend User">
    Suspend an active user, preventing them from accessing the 1Password account. Vault access configuration remains intact.
    - **uuid** (required): The UUID of the user to suspend.
  </definition>
  <definition term="Reactivate User">
    Reactivate a suspended user, restoring their access to the 1Password account.
    - **uuid** (required): The UUID of the user to reactivate.
  </definition>
</definitions>


## Connector networking configuration

Use the [Action configuration settings](/docs/reference/kibana/configuration-reference/alerting-settings#action-settings) to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.

## Get API credentials

To use the 1Password connector, you need OAuth 2.0 client credentials from a 1Password Enterprise Password Manager account:
1. Log in to your 1Password account as an Admin, Owner, or Security group member.
2. Navigate to **Integrations > OAuth Applications** and create a new application.
3. Configure the application with the required scopes: **List users**, **List user**, **Suspend user**, **Reactivate user**.
4. Save the **Client ID** and **Client Secret**. You will not be able to retrieve the secret later.
5. Copy your **Account UUID** from the admin console URL or account settings.
6. When configuring the connector in Kibana, enter the Account UUID, Client ID, and Client Secret.