1Password

Connecting from the web app?

Follow the prerequisites and credential creation instructions below, then return to Cloud Security → Settings → Providers → Add provider. Enter the provider IDs under Configuration and save the credential using New secret under Permissions. Run Test Provider, fix required failures, and save. The LimaCharlie CLI examples below are an alternative. First-time setup and verification explains the full journey.

Collects the 1Password account directory — users and groups with membership — into the identity graph, unified by email with your cloud and IdP identities. Optionally, a 1Password Connect server adds vault (secret-store) inventory.

Auth model: the account's SCIM bridge and its bearer token. This is the same provisioning endpoint your identity provider uses; the collector reads it read-only.

Prerequisites

• 1Password Business, with automated provisioning set up (hosted provisioning or a self-hosted SCIM bridge).
• The SCIM base URL and its bearer token.
• The SCIM URL must be https:// and its hostname must resolve on the public internet. Plain http://, a private or loopback address literal, and URLs with credentials embedded in them are rejected outright. The same applies to a Connect URL. A self-hosted bridge behind a VPN or a private-only DNS name cannot be collected.
• (Optional) a running 1Password Connect server plus a Connect token, if you want vault inventory.

Get the SCIM URL and bearer token

1. Sign in to your 1Password account on the web as an owner/administrator.
2. Open Integrations (the provisioning setup page).
3. Copy the SCIM URL and the bearer token shown there.

Deployment	SCIM base URL
Hosted provisioning	https://provisioning.1password.com/scim/v2
Self-hosted SCIM bridge	Your bridge's own URL, e.g. https://scim.example.com

Use exactly the URL your identity provider is configured with — the collector appends /Users and /Groups to it, so a wrong base path shows up immediately as a failed scim_users check. A trailing slash is harmless (it is stripped), but the path before it must be right.

Why the two forms differ

Hosted provisioning serves SCIM under a /scim/v2 path, while a self-hosted bridge serves it at the root of its own domain (the address you open in a browser to reach the bridge's status page). Both are correct for their deployment — copy whichever your Integrations page shows.

This is the provisioning credential, not a new one

The bearer token and the scimsession file are cryptographically linked. If you ever regenerate credentials from the Integrations page, update both your identity provider and this secret.

Read-only by construction

The collector only issues GET /Users and GET /Groups. The SCIM token is account-scoped and all-or-nothing — 1Password does not offer a narrower read-only variant.

Optional: 1Password Connect for vault inventory

1Password Connect is a self-hosted server you deploy alongside your account. Follow 1Password's Connect documentation to deploy the server and issue an access token, then include connect_url and connect_token in the secret. The collector reads only GET /v1/vaults — vault names and metadata, never item contents. Without Connect configured, vault inventory is simply unobserved.

Create the credentials secret

Save the credential JSON as op-secret.json:

{
  "scim_url": "https://provisioning.1password.com/scim/v2",
  "scim_token": "<bearer-token>",
  "connect_url": "https://connect.example.com",
  "connect_token": "<connect-token>",
  "org_domain": "example.com"
}

Field	Required	Meaning
scim_url	✅	The SCIM base URL
scim_token	✅	The SCIM bearer token
connect_url / connect_token	—	1Password Connect, for vault inventory. Omit both if you are not running Connect.
org_domain	—	The account's primary email domain. It is merged with the provider record's internal_domains, so directory members outside that set are classified as external collaborators.

jq -Rs '{secret: .}' op-secret.json \
  | limacharlie secret set --key onepassword-scim --enabled \
  && rm -f op-secret.json

jq -Rs reads the credential file as a string and builds the secret record's {"secret": "..."} envelope for stdin. Remove any other temporary copies after verifying the saved credential.

Create the provider record

provider.yaml:

provider_type: 1password
onepassword_scim_url: "https://provisioning.1password.com/scim/v2"
credentials: hive://secret/onepassword-scim
internal_domains: [example.com]
refresh: 6h

In the web app: Add provider → 1Password, then set SCIM URL, Credentials, and Refresh interval.

Verify

limacharlie cloudsec provider test --input-file provider.yaml

Check	Required	Meaning if it fails
scim_users	✅	The bearer token was rejected or the SCIM URL is wrong — this both authenticates and reads the user directory. Nothing else is probed on failure.
scim_groups	✅	Group and membership inventory unavailable.
connect_vaults	—	Vault (secret-store) inventory unavailable. Passes with a note when Connect is simply not configured.

Troubleshooting

provider test result	Cause	Fix
scim_users fails with 404	The base URL is missing (or wrongly carrying) the /scim/v2 path	Copy the SCIM URL verbatim from the Integrations page
scim_users fails with 401	The bearer token is wrong, or credentials were regenerated	Copy the current token from the Integrations page
scim_users fails to connect	The SCIM bridge is not reachable from the public internet, or is behind an allowlist	Self-hosted bridges must be reachable; confirm DNS and TLS
The URL is rejected before any check runs	The URL is not https://, points at a private/loopback address, or embeds credentials	Use a public https:// hostname (see Prerequisites)
connect_vaults fails	Connect URL/token wrong, or the Connect token has no vault access	Verify the Connect server is running and the token grants read on the vaults you want inventoried

Known limitations

• No activity signal. Neither SCIM nor Connect exposes last-used data, so 1Password identities carry no dormancy or used-vs-granted analysis. Absence of activity is treated as unknown, never as "unused".
• Connect sees only its own vaults. The Connect API returns the vaults its token has been granted, so vault inventory is a partial view of the estate by design — grant the token read access on every vault you want inventoried.
• No vault ACLs. Connect does not expose who can open a vault, so vault-access edges are not built from this provider.