1Password

Tidal Control's 1Password integration answers two questions about your password manager: whether one is actually in use, and whether the account is configured the way you say it is. It reads no vault contents. Neither credential it accepts can open a vault.

The integration takes two separate credentials, and they do not have the same plan requirement. Most of the work in setting it up is deciding which of them your account can issue.

What this integration monitors

• A password manager is connected to Tidal Control: passes on the saved connection alone, with no API call. Either credential satisfies it
• 1Password members can be listed for access review: the member list, with each member's state as ACTIVE or SUSPENDED. Users API
• Two-factor authentication has not been disabled in 1Password: an audit event that switched two-factor authentication off fails the test and names who did it. Events API
• Single sign-on has not been disabled in 1Password: the same shape, over the SSO audit events. Events API
• Successful 1Password sign-ins used a second factor: a sign-in that succeeded at the credential step and was never asked for a second factor fails the test. Events API

Requirements

• Super User role in Tidal Control
• A 1Password Teams or Business account
• Owner, administrator, or Security group membership in 1Password
• 1Password Business for the Events API credential. Teams accounts cannot issue it

The plan requirement is split, and the console does not explain it

The Users API credential works on 1Password Teams and Business, verified against a Teams account.

The Events API credential is Business only. On a Teams account the Events Reporting section is absent from Integrations → Directory: nothing to click, and no message saying why. What makes this confusing is that the OAuth Application section stays visible on Teams, so the Users API looks available while you hunt for an Events Reporting section that is not there.

A Teams customer gets the member list and the evidence that a password manager is in use. None of the posture evidence is available.

Configuration step-by-step plan

We'll confirm which plan you are on, issue the credentials your plan allows, then add one connection per credential in Tidal Control.

Configuration steps:

1. Confirm your plan
2. Create the Events API token (Business only)
3. Create the Users API OAuth application
4. Add the connection in Tidal Control

Step 1: Confirm your plan

• Install the 1Password CLI and sign in
• Run op account get --format=json
• "type": "BUSINESS" means both credentials are available. "type": "TEAM" means the Users API only, and you can skip step 2

Read the plan from the CLI rather than from the console, for the reason in the warning above.

Step 2: Create the Events API token

Business accounts only.

• Sign in to 1password.com as an owner or administrator
• Go to Integrations → Directory and find the Events Reporting section
• Add an integration and pick any SIEM in the list. The token is the same whichever you choose
• Name it, for example Tidal Control
• Select audit events and sign-in attempts
• Leave item usage events off
• Set Expires After to Never
• Issue the token and copy it

Step 3: Create the Users API OAuth application

• Sign in to 1password.com as an owner or administrator, or as a member of the Security group
• Go to Integrations and add an OAuth Application
• Select the list users scope, and nothing else
• Leave suspend user and reactivate user unselected. Tidal Control never writes to a 1Password account
• Set a Redirect URL. The console requires one and it must be HTTPS, but the client credentials grant never uses it, so any HTTPS URL on a domain you control is fine
• Copy the client ID and the client secret

Finding your Account ID

The Account ID is the field that goes wrong most often. It is a 26-character identifier such as 56YE2TYN2VFYRLNSHKPW5NVT5E, made of letters and digits with no hyphens. It is not your sign-in subdomain, and it is not the OAuth client ID. Pasting the subdomain returns 400 invalid account UUID.

1Password does not display it in the console. Run op account list --format=json and read it from account_uuid. An Events API token carries the same value, so if you already have one from step 2 you can take it from there.

Step 4: Add the connection in Tidal Control

Each connection carries one credential type, and the type is fixed once the connection is saved. A Business account that wants both halves adds two 1Password connections, one per credential.

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to 1Password
• Choose the Credential type: Events API or Users API
• Fill in the fields for that type, and pick the Region
• Click "Create" to save the integration
• Repeat for the second credential if you have both

Configuration fields explained

The integration dialog asks for the following values.

Name:

• A descriptive name for this connection
• For example: 1Password events and 1Password users, so the two connections are told apart

Credential type:

• Events API or Users API
• Fixed once the connection is saved. To switch, create a new connection

Events API token:

• The token from step 2
• Required for an Events API connection, and stored as a secret

Account ID:

• The 26-character account identifier from step 3
• Required for a Users API connection

Client ID and Client secret:

• The OAuth application credentials from step 3
• Both required for a Users API connection. The secret is stored as a secret

Region:

• United States, Europe or Canada
• Required

Region

Both credentials are regional, and the region has to match where your 1Password account is hosted: 1password.com, 1password.eu or 1password.ca. A mismatch talks to the wrong host, so a credential that is otherwise correct still fails.

What the integration does and does not check

Five tests ship. The connector reads no vault contents, and it cannot: neither credential can open a vault.

No 1Password API returns the current state of an account policy. Authentication policy, account password policy and firewall rules are console-only, and the Insights report that lists members without two-factor authentication exports to CSV rather than to an endpoint.

So the two audit tests are detective rather than preventive. They read a window of audit events, the last 120 days, and fail on a change inside that window that weakened the account. They do not prove that two-factor authentication is switched on right now. A setting enabled before the window opened emits no event at all, and Tidal Control does not read that silence as proof of anything.

The sign-in test is the one positive measurement in the set. A successful sign-in whose second factor was never demanded is evidence of a real gap, rather than an inference from an empty audit log.

If you are comparing Tidal Control against a vendor claiming "MFA enforcement monitoring", that is the distinction worth asking them about. Whether the policy is configured correctly right now stays a document or attestation control.

Verification

The integration is working when all of the following are true:

• Settings → Integrations shows 1Password under Configured Integrations
• 1Password tests are available in the Tests section
• A Users API connection returns your member list, with the states you expect
• An Events API connection returns audit events and sign-in attempts without authentication errors

Frequently asked questions

Can Tidal Control read the contents of my vaults? No, and it could not if it wanted to. The Events API token is scoped to event feeds and the Users API application to the member list. Neither is a secrets-retrieval credential, and no vault or item endpoint is called.

Why does one 1Password account need two connections? The two credentials are different things: a bearer token issued under Events Reporting, and an OAuth client with a client ID and secret. Tidal Control stores one credential per connection, so both halves mean two connections against the same account.

We are on Teams. What do we lose? The three posture tests, which all read the Events API. You keep the member list for access review and the evidence that a password manager is in use.

How far back do the audit tests look? 120 days. An event older than that is outside the window and cannot be read.

Can I connect two separate 1Password accounts? Not usefully today. Both clients fetch whole collections, so the results from two accounts merge into one set and a test cannot tell them apart. Connect one account.

Common problems

400 invalid account UUID

• The Account ID is wrong. It is the 26-character identifier from op account list --format=json, not the sign-in subdomain and not the OAuth client ID

403 permission denied

• The Account ID is well formed but the credential cannot reach that account. Check that the client ID and secret belong to the same account, and that the region matches

Events Reporting is missing from Integrations → Directory

• The account is on Teams. Run op account get --format=json to confirm, and note that an active Reports trial does not change this

"Events API token is required" or "Account ID is required"

• A field for the selected credential type was left empty. The dialog shows the Events API field or the Users API fields, never both

The member list test fails on an empty result

• That is deliberate. An account always has at least its owner, so an empty member list means the fetch is broken rather than that nobody has access. Check the credential, the Account ID and the region

Two-factor or SSO tests report no results

• No matching audit event fell inside the 120-day window. That is the expected state for an account nobody has weakened, and it is not a failure

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.