1Password Datasets

1Password datasets define what a 1Password device reads from 1Password's Events API (dataset type onepassword). They attach to devices of type onepassword, and in Datasets & Profiles the category is labelled 1Password. To create and assign datasets through the web interface, see Management. For the dataset and profile model, see Overview.

Collector Types

There are three datasets, one per feed, each with its own definition id, interval, cursor, and pipeline. Each is a tile in the wizard's 1Password category.

Dataset (console title)	Definition	Definition id	Endpoint
1Password Sign-in Attempts	onepassword_signin_collector	29110	POST /api/v1/signinattempts
1Password Audit Events	onepassword_audit_collector	29111	POST /api/v1/auditevents
1Password Item Usages	onepassword_item_usage_collector	29112	POST /api/v1/itemusages

A device reads each dataset type once: the console refuses a second dataset of a type the device already reads, whether assigned on its own or through a profile (DATASET_TYPE_ALREADY_ASSIGNED, 409).

Dataset Properties

Each property left empty, or outside its range, keeps the connector's own value.

Field	Console label	Default	Range	Description
interval	Interval (Optional)	60	10–86400	Seconds between polls.
pipeline	Pre-processing pipeline (Optional)	the device's		The dataset's own pre-processing pipeline.
query_window	First poll window	1440	1–43200	Minutes back the first poll reads. Later polls read on from the cursor.
rate_limit_per_minute	Requests per minute	60	1 and up	A whole number. It can only lower the connector's rate.
retry_count	Maximum retries	3	1–10	Times a failed request is sent again.
timeout	Request timeout	60	1–300	Seconds a request may take.

How a Feed Is Read

Each feed reads on from 1Password's cursor, which the Director keeps across polls and restarts:

• Its first poll asks for everything since query_window minutes ago (one day by default), 1,000 a page.
• Every request after it, the next page as well as the next poll, sends only the cursor 1Password returned.

So nothing is read twice, and nothing between two polls is missed. Each dataset keeps its cursor in the Director cluster's replicated store, under its own key, for 30 days. A dataset assigned in place of another starts from its own first poll.

Records

Each record is one of the response's items, as 1Password returns it, written to the custom log table with its dataset's definition id. A pipeline normalizes it.