{
  "schema": "aaes/capability-pack/1",
  "provider": "1password",
  "version": "1.0.0",
  "description": "1Password Connect Server API: list vaults and items, read item details, create, update and delete items in a vault.",
  "notes": "The endpoint host 'onepassword-connect.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's own 1Password Connect server host before enabling, in every endpoint, in the resource locator and in every egress allowlist entry. The Connect server is deployed in the customer's own infrastructure, so the host is per-deployment, not a shared SaaS host, and the allowlist moves with it; the allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step.\n\nThis pack registers only operations the retrieved Connect API reference (version 1.8.1) establishes: listing vaults, listing items in a vault, reading one item, creating an item, updating a subset of item attributes with RFC 6902 JSON Patch, and deleting an item. VAULT_UUID and ITEM_UUID in the endpoint paths are placeholders the deployment binds before enabling. The Connect server's authorization model is per-token vault scoping: a capability works only if the token was granted access to the target vault, and the registration records the endpoint, not the Connect server's authorization decision.\n\nExcluded operations: file operations (GET /v1/vaults/{vaultUUID}/items/{itemUUID}/files and the file content endpoint return the raw bytes of item attachments — bulk secret exfiltration material, requiring its own review); the full-item replacement PUT /v1/vaults/{vaultUUID}/items/{itemUUID} (PATCH covers the intended update surface; a wholesale replace silently discards any field the caller omits, and the reviewed documentation does not establish a restore path for an overwritten item); API activity listing (GET /v1/activity — an audit surface, not an agent tool); and the server heartbeat, health and metrics endpoints.\n\nThis pack does not register vault creation or deletion — nothing in this pack creates or deletes a vault, and deleting the last item does not delete the vault. Item deletion is registered as delete at the minimum R3 tier: delete is one of the designated actions requiring human approval, the reviewed documentation does not establish a trash or restore path for an item deleted through the Connect API, and the deployment must not assume one.",
  "credential": {
    "secret_ref_id": "secret-ref-1password-connect-token",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "A 1Password Connect access token for this Connect API, held in the client's own secret manager. A 1Password Service Account token is not an acceptable substitute: a service account authenticates against 1Password's own service endpoints, not against a customer-deployed Connect server, and this pack registers the Connect API only. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the Connect access token.\n\nToken issuance is external and Connect-specific: according to the reviewed Connect documentation, the first access token is created during the Secrets Automation setup when the Connect server is deployed, and additional tokens can be issued later (for example with 'op connect token create'); neither flow is performed by AAES, and the HTTP injector injects the stored value verbatim with no token lifecycle of its own.\n\nVault permissions are fixed per token at issuance — the reviewed documentation states that changing the vaults a token can access means issuing a new token — so issue each token scoped to exactly the vaults these capabilities touch.\n\nExpiry and revocation: the retrieved Connect documentation establishes no automatic expiry for Connect tokens, so treat a token as valid until revoked; revocation removes the token from the Connect server's authorized set, and note that stopping issuance or narrowing a token's vault access does not invalidate copies of the token already distributed, so rotation means replacing the stored value everywhere it was copied.\n\nLeast privilege: grant the token only the vaults and the access level the enabled capabilities need — the Connect server enforces per-token vault access, not per-endpoint rights, so a token with write access to a vault can delete its items.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack."
  },
  "capabilities": [
    {
      "capability_id": "1password.vaults.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "onepassword-connect.invalid"
      ],
      "endpoint": "https://onepassword-connect.invalid/v1/vaults",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-1password-connect-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "onepassword-connect",
      "description": "List the vaults the token can access, with the documented name filter; this pack registers the collection read only — single-vault details (GET /v1/vaults/{vaultUUID}) are not registered. Vault names and descriptions reveal the organization's secret-management structure, classified as internal data.\n\nThe host is a reserved placeholder: substitute the customer's Connect server host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "1password.items.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "onepassword-connect.invalid"
      ],
      "endpoint": "https://onepassword-connect.invalid/v1/vaults/VAULT_UUID/items",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-1password-connect-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "onepassword-connect",
      "description": "List the items in one vault, with the documented title and tag filters; this pack registers the collection read only — full item details with field values are the separate 1password.item.details.read capability. Item titles, tags and categories reveal what credentials exist and where, classified as internal data. VAULT_UUID is a placeholder the deployment binds to a concrete vault before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "1password.item.details.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "onepassword-connect.invalid"
      ],
      "endpoint": "https://onepassword-connect.invalid/v1/vaults/VAULT_UUID/items/ITEM_UUID",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-1password-connect-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "onepassword-connect",
      "description": "Read one item’s field values, including stored usernames, passwords, and other secrets. Returning a secret discloses it; the read can have lasting confidentiality consequences. The documented categories also include passports, driver’s licences, social security numbers, and medical records.\n\nClassification: pii (personal data), at the minimum R0 read tier, matching the library’s secret-value read. R0 does not make secret disclosure harmless. Deployment policy must limit who can call this capability. Bind VAULT_UUID and ITEM_UUID before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "1password.item.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "onepassword-connect.invalid"
      ],
      "endpoint": "https://onepassword-connect.invalid/v1/vaults/VAULT_UUID/items",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-1password-connect-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create"
      ],
      "resource_id": "onepassword-connect",
      "description": "Create an item in one vault using a FullItem body containing title, category, tags, sections, and fields with values or generation recipes. The request can carry stored secrets or identity-document categories.\n\nRequest limits: the registration does not restrict categories or field values. Enforce any intended restrictions separately; the token’s vault permissions determine which vault it can reach. A created item can be deleted, so the capability uses the minimum R2 create tier.\n\nClassification: pii (personal data) because the body can contain secrets and identity-document data. Bind VAULT_UUID before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "1password.item.update",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "onepassword-connect.invalid"
      ],
      "endpoint": "https://onepassword-connect.invalid/v1/vaults/VAULT_UUID/items/ITEM_UUID",
      "method": "PATCH",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-1password-connect-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "update",
        "delete"
      ],
      "resource_id": "onepassword-connect",
      "description": "Add, remove, or replace attributes and fields of one item using RFC 6902 JSON Patch, with paths expressed as RFC 6901 JSON Pointer. Removing a field destroys its stored secret value. The API exposes item version numbers, but the reviewed reference establishes no rollback through this endpoint.\n\nRequest limits: the patch body is unrestricted by this registration; it does not limit which paths may be changed. The capability declares update and delete at the minimum R3 tier because it can delete fields. Full-item replacement with PUT is excluded; see the pack notes.\n\nOn supported AAES-mediated execution paths, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.\n\nClassification: pii (personal data) because patch values can contain secrets. Bind VAULT_UUID and ITEM_UUID before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "1password.item.delete",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "onepassword-connect.invalid"
      ],
      "endpoint": "https://onepassword-connect.invalid/v1/vaults/VAULT_UUID/items/ITEM_UUID",
      "method": "DELETE",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-1password-connect-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "delete"
      ],
      "resource_id": "onepassword-connect",
      "description": "Delete one item from a vault. Deleting an item destroys the stored secret and every field in it — re-creating an item later is new content, not an undo — and the retrieved Connect API documentation does not establish a trash or restore path for items deleted through this endpoint, so this pack makes no reversibility claim. Registered as delete at the minimum R3 tier: delete is one of the irreversible actions.\n\nOn supported AAES-mediated execution paths, these declared actions require approval by an authorized person. This does not prevent calls through bypass or observation-only paths. VAULT_UUID and ITEM_UUID are placeholders the deployment binds before enabling.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "onepassword-connect",
      "kind": "api",
      "locator": "https://onepassword-connect.invalid/v1",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-22",
    "sources": [
      "https://developer.1password.com/docs/connect/connect-api-reference (retrieved 2026-09-21)",
      "https://developer.1password.com/docs/connect/get-started (retrieved 2026-09-21)"
    ],
    "reviewer_id": "aaes-eng"
  }
}