An export to explain
Priya Sharma, IT manager at Acme Ltd, asked who had exported items from shared vaults this week. Memtro listed two exports with who made them, the app and the operating system, and the vault and item ids.
1Password Events + Memtro
Who revealed or exported items from our shared vaults this week?
1Password Events connects Memtro to your 1Password Business audit trail through the Events API, and reads and nothing else. It reads audit events, showing which team member did what to which object, such as changing a vault's permissions or suspending a user. It reads item usages in shared vaults, revealed, copied, filled, edited or exported and by whom, and sign-in attempts with the reason any failed. People are named with their email, and places are countries. IP addresses and finer locations are never returned, and item usages carry vault and item ids, not titles.
In Memtro
What you can do with 1Password Events in Memtro
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right 1Password Events tool, reads what it needs, and answers with the source cited.
Reads
- 01Shows which event feeds the token may read, when it was issued and the account's id
- 02Lists audit events in a time window with who did what to which object and, where that was a person, to whom, counted by action
- 03Lists item usages in shared vaults, such as reveal, copy, fill, edit or export, with who used the item and the app and operating system
- 04Lists sign-in attempts with success or the kind of failure, the country, the app and whose account it was, counted by category
- 05Names people by name and email, and places by country only, never by IP address
- 06Covers the last 24 hours unless you name a time window
In practice
Ask it like you would a colleague
Once 1Password Events is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
1Password Events + Memtro
Who exported items from shared vaults this week?
Which sign-in attempts failed yesterday, and from which countries?
Who changed vault permissions this month?
Was anyone suspended in the last seven days?
Which feeds can this token read?
Failed sign-ins overnight
Dan Fletcher, security lead at Northwind, asked which sign-in attempts had failed overnight. Memtro counted them by category and showed that most were failed second factors on one account from one country.
Teams
Where it fits
The teams that lean on 1Password Events most, a question each of them asks, and what they connect beside it.
- EngineeringKeep decisions from evaporatingEngineer, Tech lead, On call, New joiner“Who owns the billing migration, and what did we decide about retries?”Used alongside GitHub, Linear, Jira, Confluence, Slack and 5 more.
- ProductHear what customers actually ask forProduct manager, Researcher, Designer, Head of product“Which customers asked for SSO this quarter, and what is their combined ARR?”Used alongside Help Scout, HubSpot, Linear, Jira, Slack and 6 more.
- Agent buildersMemory and tools for the agents you buildSolo builder, Platform team, Automation engineer, Whoever signs it off“Search memtro for what we know about Acme before drafting the proposal”Used alongside GitHub, Linear and Slack.
Better together
Works with
A record in 1Password Events is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
- Work management1Password Events with JiraJQL search, issue details and projects from Jira Cloud.
- Work management1Password Events with Clio ManageAsk the matter: its client, its fee earner, the time on it and what is still unbilled.
- Work management1Password Events with LinearIssues, projects and teams, synced hourly into memory.
- Support1Password Events with Help ScoutAI that reads your support conversations and cross-references the customer everywhere else.
- Support1Password Events with ZendeskEvery ticket, reply and internal note, ready to be asked about.
- Support1Password Events with IntercomCustomer conversations and the people behind them, in your company memory.
- Documents and wikis1Password Events with NotionSearch pages and query databases, and write to them when you ask.
- Documents and wikis1Password Events with Google DriveSearch Drive and read Docs, Sheets and Slides as text, and write a Doc when you ask.
- Documents and wikis1Password Events with ConfluenceSearch and read wiki pages, and write them when you ask.
Also in Engineering and operations
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
- GitHub
- AWS CloudWatch
- Sentry
- ServiceNow
- Okta
- Twilio
- AWS CloudTrail
- GitLab
- Bitbucket
- Vercel
- PagerDuty
- Datadog
- Grafana
- incident.io
- Azure DevOps
- CircleCI
- Cloudflare
- LaunchDarkly
- New Relic
- Rollbar
- Snyk
- Better Stack
- Buildkite
- DigitalOcean
- Heroku
- Netlify
- SonarQube Cloud
- Statuspage
UptimeRobot- Axiom
- BugSnag
- Checkly
- Hetzner Cloud
Honeycomb- Pingdom
- Render
- Statsig
- Sumo Logic
- Supabase
- HCP Terraform
- Vultr
- Airbrake
- Codecov
Cronitor- Dynatrace
FireHydrant- Fly.io
- Honeybadger
- Akamai Linode
- Octopus Deploy
- Pulumi
- Rootly
- Semgrep
- Splunk
StatusCake- Tailscale
- Argo CD
- authentik
- Coolify
- Gitea
GlitchTip
GLPI- Jenkins
Langfuse
LibreNMS- n8n
NetBox- Portainer
- Prefect
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone- OpenAI (usage and cost)
- Anthropic (usage and cost)
- Algolia
- Flagsmith
- Unleash
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert- KnowBe4
JumpCloud
ConfigCat- Railway
- Fastly
- Postman
- Make
- Braintrust
- OpenRouter
- ElevenLabs
Split- Scaleway
Aikido Security- AssemblyAI
Astronomer- Bamboo
- Baseten
- Bitrise
- Bitwarden
- BrowserStack
- bunny.net
- Cachet
- Checkmk
- Civo
- Cloudsmith
- Codacy
- Codemagic
Comet Opik- Coralogix
CrowdStrike Falcon- Dagster+
- DeepSource
Detectify- Docker Hub
Domotz- Grafana OnCall
- Harness
- Hugging Face
- Instatus
- Koyeb
- Lambda Cloud
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary- Mezmo
NinjaOne- Nomad
Northflank- Oh Dear
- OVHcloud
Portkey- Probely (Snyk API & Web)
PromptLayer- Proxmox VE
PRTG Network Monitor- Qase
Raygun
Retell AI- Retool
Runpod- SecurityScorecard
- Semaphore CI
Shodan- SigNoz
- Socket
Spike.sh
Squadcast- SwaggerHub
- TeamCity
Tenable- Together AI
- Travis CI
UpGuard
Uptime.com
Vanta- Vapi
- Windmill
Zenduty- OpsLevel
Cortex- Auth0
- Clerk
WorkOS
Kandji
Automox
Huntress- HackerOne
SimpleMDM- AppSignal
Healthchecks.io
Rapid7 InsightVM- JFrog Artifactory
- Sauce Labs
Zenhub- Deepgram
- Replicate
Setup
How to connect
Connect withEvents Reporting bearer token
- 1
In 1Password.com, open Integrations → Directory → Events Reporting → Other. Only an owner or administrator can issue a token.
- 2
Name the integration Memtro, set up a token with its expiry and the events to report (audit events, item usage, sign-in attempts), then issue it and copy it. It is shown once.
- 3
In Memtro, open Connections → 1Password Events and paste it into Events Reporting bearer token. Set 1Password server if you sign in at ent.1password.com, 1password.ca or 1password.eu.
- 4
Ask your first question: who exported items from shared vaults this week?
Also works from
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The 1Password Events tools are the same everywhere.
FAQ
Questions
Can Memtro change anything in 1Password Events?+
Not yet. Today every 1Password Events tool reads, searches or lists. When the connector gains actions, each is marked, granted by name per team and used only when a person asks for exactly that, so nothing is created, sent, updated or deleted until you say so.
Who can use a 1Password Events connection?+
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Does Memtro store my 1Password Events data?+
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
How do I connect 1Password Events?+
Events Reporting bearer token. In 1Password.com, open Integrations → Directory → Events Reporting → Other. Only an owner or administrator can issue a token.
Connect 1Password Events in a few minutes
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.