Specify a time period and ask AI to organize the security event records relevant to your investigation.
Copy a prompt into your agent with the oo Skill installed. Add your page links and source notes before running it.
Summarize sign-in event records for a defined investigation period.
/oo 1Password Events API: Read 1Password sign-in attempts from [start date and time] to [end date and time], in [time zone]. Summarize outcomes and unusual patterns with event references.
Set up oo CLI and the oo Skill in your agent.
Install OOMOL →Create a 1Password Events Reporting integration and connect its bearer token and Events API Server URL.
Connect 1Password Events API →Use /oo with the pages to read, the changes to make, and where to save the result.
Connection Guide →Choose Your Agent
The integration reads three Events Reporting streams: audit events, item usages, and sign-in attempts. It does not retrieve vault passwords or edit items.
Read audit activity, item usage, and sign-in attempt records.
List 1Password audit events using the official cursor-based Events API.
Leina 
Wanta 
one_password_events.list_audit_events List 1Password item usage events using the official cursor-based Events API.
one_password_events.list_item_usages List 1Password sign-in attempts using the official cursor-based Events API.
one_password_events.list_sign_in_attempts No matching tools.
Provide the start and end date-time with a time zone. These values start a new event query.
Yes. The continuation cursor resumes that query. Use it on its own, without new dates or a new result limit.
These operations read usage event records, not the passwords or secret contents stored in vault items.
Manage which optional storage OOMOL can use. You can change these choices from the footer at any time.