Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt

Use this file to discover all available pages before exploring further.

This guide walks you through connecting your 1Password Business account to Clarion via the 1Password Events Reporting API. Once connected, Clarion polls 1Password every minute for audit events, sign-in attempts, and item usage events, and uses them to detect suspicious activity and create alerts.
Estimated time: 5 minutes. You will need 1Password Business with permission to set up Events Reporting integrations.

​
Prerequisites

  • A 1Password Business account with access to Integrations → Directory
  • A Clarion workspace with the 1Password integration page open
  • A secure place to store the bearer token generated in 1Password

​
Step 1 — Create a bearer token in 1Password

  1. Sign in to your 1Password account.
  2. Go to Integrations → Directory.
  3. Under Events Reporting, click Other and set up a new integration.
  4. Select the event types to report:
    • Audit events
    • Sign-in attempts
    • Item usage events
  5. Copy the generated bearer token.
Copy the bearer token immediately — it will only be shown once. Store it securely.

​
Step 2 — Enter the bearer token in Clarion

  1. In Clarion, open Integrations → 1Password.
  2. Paste the Bearer Token from 1Password.
  3. Click Connect.
Clarion validates the token and begins polling the Events Reporting API for new events every minute.

​
What happens next

Once connected, Clarion will:
  • Poll 1Password every minute for audit events, sign-in attempts, and item usage events
  • Create alerts from suspicious activity based on your configured alert filters
  • Use 1Password event data to enrich investigations and triage
You can manage which events create alerts from the Alert Filters section on the 1Password integration page.

​
Update or rotate the bearer token

To replace the bearer token (for example, after rotating it in 1Password):
  1. Generate a new bearer token in 1Password under Integrations → Directory → Events Reporting.
  2. In Clarion, open Integrations → 1Password.
  3. Paste the new token into Update Bearer Token and click Update Token.

​
Troubleshooting

​
The connection fails or events stop arriving

  • Confirm the bearer token was generated for the correct 1Password account and has not been revoked
  • Verify the integration in 1Password still includes audit events, sign-in attempts, and item usage events
  • Use Sync now on the 1Password integration page in Clarion to trigger an immediate poll