1Password

automations/read-production-secret.automation.ts

import { automation, markSignificant, onSchedule } from "automate.ax"
import { onePassword } from "automate.ax/onepassword"

export default automation("Read a rotating secret", () => {
  onSchedule({ schedule: "0 * * * *" })

  const secret = onePassword.resolveSecret({
    secretReference: "op://Production/API/password",
  })
  markSignificant(secret)
})

Choose a 1Password connection

Use a service account for secret references, items, files, sharing, vaults, groups, and Environments. Create it in 1Password with only the required vault permissions. Service-account permissions and Environment assignments are immutable. Built-in personal, private, employee, and default shared vaults are unavailable. Vault deletion and group-permission changes work only on vaults created by that service account. Use an Events API token for audit events, item usages, and sign-in attempts. Choose the regional origin shown by 1Password: events.1password.com, events.1password.ca, events.1password.eu, or events.ent.1password.com. Automate.ax rejects other origins. Create named bindings with onePasswordAccount("name") or pass { account: "name" } as an action’s second argument. generatePassword runs locally and needs no account.

Use secrets in a custom integration

Use resolveSecret to supply credentials when you call an unsupported API. Store each restricted provider credential in a vault available to the connected service account, then pass the sensitive result signal directly to the custom action that needs it.

Poll Events Reporting

1Password Events Reporting provides cursor-based pull APIs, not webhooks. Use the list actions from a scheduled automation. Begin with optional time bounds and a limit, then persist and pass the returned cursor to continue. The integration does not expose event triggers.

1Password results stay sensitive

Resolved secrets, decrypted items, files, generated passwords, Environment variables, share links, recipient identities, vault and group metadata, and event activity are declared sensitive at their action boundaries. See 1Password’s service-account setup, SDK documentation, and Events API setup.

Exports

import {
  onePassword,
  onePasswordAccount,
  getOnePasswordClient,
  getOnePasswordEventsApi,
} from "automate.ax/onepassword"

onePassword contains the packaged 1Password actions.
onePasswordAccount("name") selects a named 1Password connection.
getOnePasswordClient creates the authenticated 1Password service-account client for a custom account-backed action.
getOnePasswordEventsApi creates the authenticated 1Password Events Reporting API helper for a custom account-backed action.

Built-in triggers

Built-in actions

Runtime utilities

Integrations

Choose a 1Password connection

Use secrets in a custom integration

Poll Events Reporting

1Password results stay sensitive

Exports

Actions

​Choose a 1Password connection

​Use secrets in a custom integration

​Poll Events Reporting

​1Password results stay sensitive

​Exports

​Actions

Choose a 1Password connection

Use secrets in a custom integration

Poll Events Reporting

1Password results stay sensitive

Exports

Actions