1Password Event

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://developer.1password.com/schemas/1password/event.json",
  "title": "1Password Event",
  "description": "Represents event data from the 1Password Events API, including sign-in attempts, item usage records, and audit events used for security monitoring and compliance.",
  "type": "object",
  "oneOf": [
    { "$ref": "#/$defs/SignInAttempt" },
    { "$ref": "#/$defs/ItemUsage" },
    { "$ref": "#/$defs/AuditEvent" }
  ],
  "$defs": {
    "SignInAttempt": {
      "type": "object",
      "description": "A record of a sign-in attempt to a 1Password account.",
      "required": ["uuid", "timestamp", "category"],
      "properties": {
        "uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The unique identifier for the sign-in attempt."
        },
        "session_uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The UUID of the session associated with the sign-in attempt."
        },
        "timestamp": {
          "type": "string",
          "format": "date-time",
          "description": "When the sign-in attempt occurred in ISO 8601 format."
        },
        "category": {
          "type": "string",
          "description": "The overall result category of the sign-in attempt.",
          "enum": [
            "success",
            "credentials_failed",
            "mfa_failed",
            "modern_version_required",
            "sso_failed"
          ]
        },
        "type": {
          "type": "string",
          "description": "The specific type of sign-in result."
        },
        "country": {
          "type": "string",
          "description": "The two-letter ISO country code of the sign-in location.",
          "minLength": 2,
          "maxLength": 2
        },
        "target_user": {
          "$ref": "#/$defs/User"
        },
        "client": {
          "$ref": "#/$defs/Client"
        }
      }
    },
    "ItemUsage": {
      "type": "object",
      "description": "A record of an item being accessed, modified, or used in a shared vault.",
      "required": ["uuid", "timestamp", "action"],
      "properties": {
        "uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The unique identifier for the item usage record."
        },
        "timestamp": {
          "type": "string",
          "format": "date-time",
          "description": "When the item was accessed in ISO 8601 format."
        },
        "used_version": {
          "type": "integer",
          "description": "The version of the item that was used.",
          "minimum": 0
        },
        "vault_uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The UUID of the vault containing the item."
        },
        "item_uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The UUID of the item that was used."
        },
        "action": {
          "type": "string",
          "description": "The type of action performed on the item.",
          "enum": ["fill", "copy", "reveal", "sso-fill", "secure-copy"]
        },
        "user": {
          "$ref": "#/$defs/User"
        },
        "client": {
          "$ref": "#/$defs/Client"
        },
        "location": {
          "$ref": "#/$defs/Location"
        }
      }
    },
    "AuditEvent": {
      "type": "object",
      "description": "A record of an action performed by a team member within the 1Password account.",
      "required": ["uuid", "timestamp", "action"],
      "properties": {
        "uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The unique identifier for the audit event."
        },
        "timestamp": {
          "type": "string",
          "format": "date-time",
          "description": "When the action was performed in ISO 8601 format."
        },
        "actor_uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The UUID of the user who performed the action."
        },
        "actor_details": {
          "$ref": "#/$defs/User"
        },
        "action": {
          "type": "string",
          "description": "The type of action that was performed."
        },
        "object_type": {
          "type": "string",
          "description": "The type of object the action was performed on."
        },
        "object_uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The UUID of the object the action was performed on."
        },
        "aux_id": {
          "type": "integer",
          "description": "An auxiliary identifier providing additional context."
        },
        "aux_uuid": {
          "type": "string",
          "format": "uuid",
          "description": "An auxiliary UUID providing additional context."
        },
        "aux_info": {
          "type": "string",
          "description": "Additional auxiliary information about the event."
        },
        "location": {
          "$ref": "#/$defs/Location"
        }
      }
    },
    "User": {
      "type": "object",
      "description": "A 1Password user involved in an event.",
      "properties": {
        "uuid": {
          "type": "string",
          "format": "uuid",
          "description": "The unique identifier of the user."
        },
        "name": {
          "type": "string",
          "description": "The display name of the user."
        },
        "email": {
          "type": "string",
          "format": "email",
          "description": "The email address of the user."
        }
      }
    },
    "Client": {
      "type": "object",
      "description": "Information about the client application used in an event.",
      "properties": {
        "app_name": {
          "type": "string",
          "description": "The name of the 1Password application."
        },
        "app_version": {
          "type": "string",
          "description": "The version of the application."
        },
        "platform_name": {
          "type": "string",
          "description": "The name of the platform."
        },
        "platform_version": {
          "type": "string",
          "description": "The version of the platform."
        },
        "os_name": {
          "type": "string",
          "description": "The name of the operating system."
        },
        "os_version": {
          "type": "string",
          "description": "The version of the operating system."
        },
        "ip": {
          "type": "string",
          "description": "The IP address of the client."
        }
      }
    },
    "Location": {
      "type": "object",
      "description": "Geographic location information associated with an event.",
      "properties": {
        "country": {
          "type": "string",
          "description": "The two-letter ISO country code.",
          "minLength": 2,
          "maxLength": 2
        },
        "region": {
          "type": "string",
          "description": "The region or state."
        },
        "city": {
          "type": "string",
          "description": "The city name."
        },
        "latitude": {
          "type": "number",
          "description": "The latitude coordinate."
        },
        "longitude": {
          "type": "number",
          "description": "The longitude coordinate."
        }
      }
    }
  }
}