1Password is a widely trusted password manager and secrets vault solution, allowing individuals and teams to securely store, access, and share passwords, API credentials, and sensitive information. With robust encryption, granular access controls, and seamless syncing across devices, 1Password supports teams and organizations in managing secrets efficiently and securely.
The 1Password Connect API allows programmatic access to vaults and items within an organization's 1Password account. This integration in SteelEngine lets you automate secret retrieval, onboarding workflows, secret rotation, vault audits, and more, all in a secure and auditable manner.
With 1Password in your SteelEngine workflow, you can:
- List, search, and retrieve vaults: Access metadata or browse available vaults for organizing secrets by project or purpose
- Fetch items and secrets: Get credentials, API keys, or custom secrets in real time to power your workflows securely
- Create, update, or delete secrets: Automate secret management, provisioning, and rotation for enhanced security practices
- Integrate with CI/CD and automation: Fetch credentials or tokens only when needed, reducing manual work and reducing risk
- Ensure access controls: Leverage role-based access and fine-grained permissions to control which agents or users can access specific secrets
By connecting SteelEngine with 1Password, you empower your agents to securely manage secrets, reduce manual overhead, and maintain best practices for security automation, incident response, and DevOps workflows—all while ensuring secrets never leave a controlled environment.
Usage Instructions
Access and manage secrets stored in 1Password vaults using the Connect API or Service Account SDK. List vaults, retrieve items with their fields and secrets, create new items, update existing ones, delete items, and resolve secret references.
Tools
onepassword_list_vaults
List all vaults accessible by the Connect token or Service Account
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
filter | string | No | SCIM filter expression (e.g., name eq "My Vault") |
Output
| Parameter | Type | Description |
|---|---|---|
vaults | array | List of accessible vaults |
↳ id | string | Vault ID |
↳ name | string | Vault name |
↳ description | string | Vault description |
↳ attributeVersion | number | Vault attribute version |
↳ contentVersion | number | Vault content version |
↳ type | string | Vault type (USER_CREATED, PERSONAL, EVERYONE, TRANSFER) |
↳ createdAt | string | Creation timestamp |
↳ updatedAt | string | Last update timestamp |
onepassword_get_vault
Get details of a specific vault by ID
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID |
Output
| Parameter | Type | Description |
|---|---|---|
id | string | Vault ID |
name | string | Vault name |
description | string | Vault description |
attributeVersion | number | Vault attribute version |
contentVersion | number | Vault content version |
items | number | Number of items in the vault |
type | string | Vault type (USER_CREATED, PERSONAL, EVERYONE, TRANSFER) |
createdAt | string | Creation timestamp |
updatedAt | string | Last update timestamp |
onepassword_list_items
List items in a vault. Returns summaries without field values.
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID to list items from |
filter | string | No | SCIM filter expression (e.g., title eq "API Key" or tag eq "production") |
Output
| Parameter | Type | Description |
|---|---|---|
items | array | List of items in the vault (summaries without field values) |
↳ id | string | Item ID |
↳ title | string | Item title |
↳ vault | object | Vault reference |
↳ id | string | Vault ID |
↳ category | string | Item category (e.g., LOGIN, API_CREDENTIAL) |
↳ urls | array | URLs associated with the item |
↳ href | string | URL |
↳ label | string | URL label |
↳ primary | boolean | Whether this is the primary URL |
↳ favorite | boolean | Whether the item is favorited |
↳ tags | array | Item tags |
↳ version | number | Item version number |
↳ state | string | Item state (ARCHIVED or DELETED) |
↳ createdAt | string | Creation timestamp |
↳ updatedAt | string | Last update timestamp |
↳ lastEditedBy | string | ID of the last editor |
onepassword_get_item
Get full details of an item including all fields and secrets
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID |
itemId | string | Yes | The item UUID to retrieve |
Output
This tool does not produce any outputs.
onepassword_create_item
Create a new item in a vault
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID to create the item in |
category | string | Yes | Item category (e.g., LOGIN, PASSWORD, API_CREDENTIAL, SECURE_NOTE, SERVER, DATABASE) |
title | string | No | Item title |
tags | string | No | Comma-separated list of tags |
fields | string | No | JSON array of field objects (e.g., [{"label":"username","value":"admin","type":"STRING","purpose":"USERNAME"}]) |
Output
This tool does not produce any outputs.
onepassword_replace_item
Replace an entire item with new data (full update)
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID |
itemId | string | Yes | The item UUID to replace |
item | string | Yes | JSON object representing the full item (e.g., {"vault":{"id":"..."},"category":"LOGIN","title":"My Item","fields":[...]}) |
Output
This tool does not produce any outputs.
onepassword_update_item
Update an existing item using JSON Patch operations (RFC6902)
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID |
itemId | string | Yes | The item UUID to update |
operations | string | Yes | JSON array of RFC6902 patch operations (e.g., [{"op":"replace","path":"/title","value":"New Title"}]) |
Output
This tool does not produce any outputs.
onepassword_delete_item
Delete an item from a vault
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: "service_account" or "connect" |
serviceAccountToken | string | No | 1Password Service Account token (for Service Account mode) |
apiKey | string | No | 1Password Connect API token (for Connect Server mode) |
serverUrl | string | No | 1Password Connect server URL (for Connect Server mode) |
vaultId | string | Yes | The vault UUID |
itemId | string | Yes | The item UUID to delete |
Output
| Parameter | Type | Description |
|---|---|---|
success | boolean | Whether the item was successfully deleted |
onepassword_resolve_secret
Resolve a secret reference (op://vault/item/field) to its value. Service Account mode only.
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
connectionMode | string | No | Connection mode: must be "service_account" for this operation |
serviceAccountToken | string | Yes | 1Password Service Account token |
secretReference | string | Yes | Secret reference URI (e.g., op://vault-name/item-name/field-name or op://vault-name/item-name/section-name/field-name) |
Output
| Parameter | Type | Description |
|---|---|---|
value | string | The resolved secret value |
reference | string | The original secret reference URI |