1password v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-1password-connect-token

Custody

customer_vault

Injection

header (Authorization)

A 1Password Connect access token for this Connect API, held in the client's own secret manager. A 1Password Service Account token is NOT an acceptable substitute: a service account authenticates against 1Password's own service endpoints, not against a customer-deployed Connect server, and this pack registers the Connect API only. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the Connect access token. Token issuance is external and Connect-specific: per the retrieved Connect documentation, the first access token is created during the Secrets Automation setup when the Connect server is deployed, and additional tokens can be issued later (for example with 'op connect token create'); neither flow is performed by AAES, and the HTTP injector injects the stored value verbatim with no token lifecycle of its own. Vault permissions are fixed per token at issuance — the retrieved documentation states that changing the vaults a token can access means issuing a new token — so issue each token scoped to exactly the vaults these capabilities touch. Expiry and revocation: the retrieved Connect documentation establishes no automatic expiry for Connect tokens, so treat a token as valid until revoked; revocation removes the token from the Connect server's authorized set, and note that stopping issuance or narrowing a token's vault access does not invalidate copies of the token already distributed, so rotation means replacing the stored value everywhere it was copied. Least privilege: grant the token only the vaults and the access level the enabled capabilities need — the Connect server enforces per-token vault access, not per-endpoint rights, so a token granted write vaults can delete through them. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• onepassword-connect (api, pii): https://onepassword-connect.invalid/v1

The endpoint host 'onepassword-connect.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's own 1Password Connect server host before enabling, in every endpoint, in the resource locator and in every egress allowlist entry. The Connect server is deployed in the customer's own infrastructure, so the host is per-deployment, not a shared SaaS host, and the allowlist moves with it; the allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step. This pack registers only operations the retrieved Connect API reference (version 1.8.1) establishes: listing vaults, listing items in a vault, reading one item, creating an item, updating a subset of item attributes with RFC 6902 JSON Patch, and deleting an item. VAULT_UUID and ITEM_UUID in the endpoint paths are placeholders the deployment binds before enabling. The Connect server's authorization model is per-token vault scoping: a capability works only if the token was granted access to the target vault, and the registration records the endpoint, not the Connect server's authorization decision. Documented exclusions — this pack does not register: file operations (GET /v1/vaults/{vaultUUID}/items/{itemUUID}/files and the file content endpoint return the raw bytes of item attachments — bulk secret exfiltration material, requiring its own review); the full-item replacement PUT /v1/vaults/{vaultUUID}/items/{itemUUID} (PATCH covers the intended update surface; a wholesale replace silently discards any field the caller omits, and the retrieved documentation does not establish a restore path for an overwritten item); API activity listing (GET /v1/activity — an audit surface, not an agent tool); and the server heartbeat, health and metrics endpoints. This pack does not register vault creation or deletion — nothing in this pack creates or deletes a vault, and deleting the last item of a vault is an item delete, not a vault delete. Item deletion is registered as delete at the R3 floor: delete is one of the IRREVERSIBLE ACTIONS, the retrieved documentation does not establish a trash or restore path for an item deleted through the Connect API, and the deployment must not assume one.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://developer.1password.com/docs/connect/connect-api-reference (retrieved 2026-09-21)
• https://developer.1password.com/docs/connect/get-started (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.