1Password

Manage secrets and items in 1Password vaults

1Password is a widely trusted password manager and secrets vault solution, allowing individuals and teams to securely store, access, and share passwords, API credentials, and sensitive information. With robust encryption, granular access controls, and seamless syncing across devices, 1Password supports teams and organizations in managing secrets efficiently and securely.

The 1Password Connect API allows programmatic access to vaults and items within an organization's 1Password account. This integration in Sim lets you automate secret retrieval, onboarding workflows, secret rotation, vault audits, and more, all in a secure and auditable manner.

With 1Password in your Sim workflow, you can:

  • List, search, and retrieve vaults: Access metadata or browse available vaults for organizing secrets by project or purpose
  • Fetch items and secrets: Get credentials, API keys, or custom secrets in real time to power your workflows securely
  • Create, update, or delete secrets: Automate secret management, provisioning, and rotation for enhanced security practices
  • Integrate with CI/CD and automation: Fetch credentials or tokens only when needed, reducing manual work and reducing risk
  • Ensure access controls: Leverage role-based access and fine-grained permissions to control which agents or users can access specific secrets

By connecting Sim with 1Password, you empower your agents to securely manage secrets, reduce manual overhead, and maintain best practices for security automation, incident response, and DevOps workflows—all while ensuring secrets never leave a controlled environment.

Usage Instructions

Access and manage secrets stored in 1Password vaults using the Connect API or Service Account SDK. List vaults, retrieve items with their fields and secrets, create new items, update existing ones, delete items, and resolve secret references.

Tools

onepassword_list_vaults

List all vaults accessible by the Connect token or Service Account

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
filterstringNoSCIM filter expression (e.g., name eq "My Vault")

Output

ParameterTypeDescription
vaultsarrayList of accessible vaults
idstringVault ID
namestringVault name
descriptionstringVault description
attributeVersionnumberVault attribute version
contentVersionnumberVault content version
typestringVault type (USER_CREATED, PERSONAL, EVERYONE, TRANSFER)
createdAtstringCreation timestamp
updatedAtstringLast update timestamp

onepassword_get_vault

Get details of a specific vault by ID

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID

Output

ParameterTypeDescription
idstringVault ID
namestringVault name
descriptionstringVault description
attributeVersionnumberVault attribute version
contentVersionnumberVault content version
itemsnumberNumber of items in the vault
typestringVault type (USER_CREATED, PERSONAL, EVERYONE, TRANSFER)
createdAtstringCreation timestamp
updatedAtstringLast update timestamp

onepassword_list_items

List items in a vault. Returns summaries without field values.

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID to list items from
filterstringNoSCIM filter expression (e.g., title eq "API Key" or tag eq "production")

Output

ParameterTypeDescription
itemsarrayList of items in the vault (summaries without field values)
idstringItem ID
titlestringItem title
vaultobjectVault reference
idstringVault ID
categorystringItem category (e.g., LOGIN, API_CREDENTIAL)
urlsarrayURLs associated with the item
hrefstringURL
labelstringURL label
primarybooleanWhether this is the primary URL
favoritebooleanWhether the item is favorited
tagsarrayItem tags
versionnumberItem version number
statestringItem state (ARCHIVED or DELETED)
createdAtstringCreation timestamp
updatedAtstringLast update timestamp
lastEditedBystringID of the last editor

onepassword_get_item

Get full details of an item including all fields and secrets

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID
itemIdstringYesThe item UUID to retrieve

Output

ParameterTypeDescription
responsejsonOperation response data

onepassword_create_item

Create a new item in a vault

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID to create the item in
categorystringYesItem category (e.g., LOGIN, PASSWORD, API_CREDENTIAL, SECURE_NOTE, SERVER, DATABASE)
titlestringNoItem title
tagsstringNoComma-separated list of tags
fieldsstringNoJSON array of field objects (e.g., [{"label":"username","value":"admin","type":"STRING","purpose":"USERNAME"}])

Output

ParameterTypeDescription
responsejsonOperation response data

onepassword_replace_item

Replace an entire item with new data (full update)

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID
itemIdstringYesThe item UUID to replace
itemstringYesJSON object representing the full item (e.g., {"vault":{"id":"..."},"category":"LOGIN","title":"My Item","fields":[...]})

Output

ParameterTypeDescription
responsejsonOperation response data

onepassword_update_item

Update an existing item using JSON Patch operations (RFC6902)

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID
itemIdstringYesThe item UUID to update
operationsstringYesJSON array of RFC6902 patch operations (e.g., [{"op":"replace","path":"/title","value":"New Title"}])

Output

ParameterTypeDescription
responsejsonOperation response data

onepassword_delete_item

Delete an item from a vault

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: "service_account" or "connect"
serviceAccountTokenstringNo1Password Service Account token (for Service Account mode)
apiKeystringNo1Password Connect API token (for Connect Server mode)
serverUrlstringNo1Password Connect server URL (for Connect Server mode)
vaultIdstringYesThe vault UUID
itemIdstringYesThe item UUID to delete

Output

ParameterTypeDescription
successbooleanWhether the item was successfully deleted

onepassword_resolve_secret

Resolve a secret reference (op://vault/item/field) to its value. Service Account mode only.

Input

ParameterTypeRequiredDescription
connectionModestringNoConnection mode: must be "service_account" for this operation
serviceAccountTokenstringYes1Password Service Account token
secretReferencestringYesSecret reference URI (e.g., op://vault-name/item-name/field-name or op://vault-name/item-name/section-name/field-name)

Output

ParameterTypeDescription
valuestringThe resolved secret value
referencestringThe original secret reference URI

On this page

Start building today
Trusted by over 60,000 builders.
Build Agentic workflows visually on a drag-and-drop canvas or with natural language.
Get started