> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/password-managers/1password.md).

# 1Password

By integrating **1Password** with **ThreatDefence** via the **1Password Events Reporting API**, you can seamlessly ingest user activity and security event data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

* Password management behavior
* Vault access
* Policy enforcement

It enables more effective detection of insider threats, credential misuse, and compliance violations.

***

## Requirements

* Access to your **1Password admin account**
* An active **1Password service account** (recommended for automation or API integration)

***

## Step 1. Generate a 1Password Events API Token

1. Sign in to your account at **1password.com**.
2. Select **Integrations** in the sidebar.
3. Under **Events Reporting**, click **Add Integration**.
4. Enter a name for the integration, for example: **ThreatDefence - Log Integration**.
5. Click **Add Integration**.
6. Click **Add a Token**, then enter a name for the token and choose an expiry (or leave as **Never**).
7. Select the event types the token should have access to:

* Sign-in Attempts
* Item Usages
* Audit Event

8. Click **Issue Token**.
9. Copy the token value and store it securely.

⚠️ The token value cannot be retrieved again after closing this page.

For more information on issuing or revoking tokens, refer to the official 1Password guide:\
[➡ 1Password Events Reporting Guide](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens)

***

## Step 2. Configure ThreatDefence Integration

Provide the following information to your ThreatDefence representative at [**support@threatdefence.com**](mailto:support@threatdefence.com):

* API Key (the token genertaed in Step 1)

***

#### Self Setup via TD Portal

If you prefer to configure the integration yourself, you can do so directly through the TD portal without contacting support.

1. Sign into **TD Portal**.
2. Navigate to **Integrations → Add**.
3. Select **1Password** from the list of available integrations.
4. Enter your **API Key** (generated in Step 1 above).
5. Click **ADD**.

{% hint style="info" %}
For more information go to: <https://docs.threatdefence.com/platform-management/managing-integrations>
{% endhint %}

***

## Support

For questions or assistance, please contact:\
📧 **<support@threatdefence.com>**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/password-managers/1password.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.