1Password Extension

Connect your own 1Password Connect Server (self-hosted, Bearer access token) by saving its base URL and access token, after checking it actually works.

List the connected 1Password Connect servers.

Disconnect a 1Password Connect server: deletes the saved base URL/access token. Nothing in 1Password itself is changed.

List vaults this 1Password Connect server was granted access to. There is no way to list every vault in the account -- only the ones this server's token can reach.

Read one vault's metadata in full by id.

List items (logins, passwords, secure notes, API credentials, and more) inside one vault. Item summaries do NOT include secret field values -- use get_item for those.

Read one item in full, INCLUDING its secret field values (passwords, API keys, private notes). This exposes real credentials -- use only when you actually need the secret value.

Create a new item (login, password, secure note, API credential, etc) in a vault. Cannot create CUSTOM or DOCUMENT category items -- 1Password's own API restriction.

Update selected fields of an existing item using RFC6902 JSON Patch operations (add/remove/replace). Only the given operations change; everything else on the item stays as-is.

Permanently delete an item from a vault. Cannot be undone.

List file attachments on an item (e.g. a document or image attached to a secure note).

Read one file attachment's metadata (name, size) by id.

Download a file attachment's actual content, base64-encoded. Exposes real file data -- use only when you actually need the file's bytes.

List API activity (audit trail) for this Connect server's own access token usage.

Build one aggregated health report across every vault this Connect server can reach: item count and category breakdown per vault.

Value-add report: scan one vault's items and flag every one not updated in at least the given number of days -- candidates for password rotation review.