1Password

Probo reads your 1Password account’s members so you can review who has access. The recommended method is client credentials from a 1Password OAuth application, which Probo uses to call the 1Password Users API. 1Password does not support Users API integrations alongside automated user provisioning, so an account that uses provisioning connects through its SCIM Bridge instead, with the SCIM URL and bearer token its provisioning setup issued. Hosted Google Workspace provisioning connects through a Google service account and issues neither, so neither method applies to an account provisioned that way.

Caution

The client credentials form asks for your 1Password account ID, which is not the OAuth application’s client ID. Both are 26 uppercase letters and digits, so they are easy to mix up. The client ID is on the application’s page in 1Password. The account ID is in the address of the 1Password web app, as Find Your Account ID and Region shows. With the client ID in the Account ID field, the connector shows Not authorized and Probo cannot list anyone.

Prerequisites

Client Credentials

• Probo organization administrator access
• A 1Password Business or Enterprise Password Manager account. The Users API is not included with 1Password Teams
• Permission to manage integrations in 1Password, for example as an owner, an administrator or a member of the Security group
• No automated user provisioning on the account
• Your 1Password account ID and region, which Find Your Account ID and Region shows how to read

SCIM Bridge

• Probo organization administrator access
• The owner or administrator role in a 1Password Business account (automated user provisioning requires both the plan and the role)
• Automated user provisioning already in place that issued a SCIM URL and bearer token, either hosted by 1Password or on a SCIM bridge you deployed yourself
• The SCIM Bridge URL, which the connection form asks for alongside the token. Enter the bridge address with no path, as 1Password’s identity provider guides ask, for example https://scim.example.com. Probo appends /scim/v2/Users to it. For provisioning hosted by 1Password, the setup page shows a SCIM URL such as https://provisioning.1password.com/scim/v2, so drop the /scim/v2 suffix and enter https://provisioning.1password.com

Collected Fields

Client Credentials

Probo field	1Password field	Notes
Name	display_name
Email	email	A user without an email address is skipped
Role	Not supported
Admin	Not supported
Status	state	ACTIVE is listed as active and SUSPENDED as inactive. Any other state is listed as unknown
MFA	Not supported
Last login	Not supported
External ID	id	Stable identifier used to track the account across reviews
Created at	create_time	When the user was created in 1Password

1Password lists only active and suspended users, so a member who has not yet joined, is awaiting confirmation or is in account recovery does not appear in the campaign.

SCIM Bridge

Probo field	1Password field	Notes
Name	displayName	Falls back to name.formatted, then to name.givenName and name.familyName joined with a space
Email	userName	Falls back to the primary address in emails. A user with neither is skipped
Role	Not supported
Admin	Not supported
Status	active	Listed as inactive when active is false, including when the response omits the field
MFA	Not supported
Last login	Not supported
External ID	id	Stable identifier used to track the account across reviews
Created at	meta.created	When the user was created in 1Password. Left empty when the value is not an RFC 3339 timestamp

A SCIM user record has a meta.lastModified timestamp, but that timestamp records the last change to the profile rather than a sign-in, so Probo does not report it as a last login. Probo reads no role from the SCIM record either, so it flags no account as an administrator.

Connect 1Password

Option A: Client Credentials (recommended)

Create the OAuth Application

1. Sign in to 1Password.com as an owner, an administrator or a member of the Security group. Select Integrations in the sidebar, open the Directory tab if 1Password shows one, and select OAuth Application. If 1Password asks for a grant type, choose Client credentials and click Next.
2. Enter an Application Name, for example Probo Access Review.
3. Open Select scope and tick View users. Leave Suspend user and Reactivate user unticked, since Probo only reads the user list. Scopes cannot be changed after the application is created.
4. If the form shows a Redirect URL field, it is required even though the client credentials grant Probo uses never redirects, so enter any https address, for example https://www.probo.com.
5. Click Next, then copy the Client ID and the Client secret. 1Password shows the secret only once, so store it securely.

Find Your Account ID and Region

1. Select View vault items at the bottom of the 1Password.com sidebar. The address bar then reads https://<sign-in address>/app#/<account ID>/AllItems. Copy your account ID, which is the 26 characters between #/ and the next /. With the 1Password CLI signed in to this account, op account get --account <sign-in address> prints the same value as ID.
2. Read the region from the ending of the sign-in address, the host in that same address bar: .1password.eu is Europe, .1password.ca is Canada, .ent.1password.com is Enterprise (ent.1password.com), and any other address ending in .1password.com is United States.

Connect in Probo

1. In Probo, go to Settings > Connectors and click Add more to open the Marketplace.
2. Find 1Password and open it.
3. Choose Client credentials.
4. Enter a Name for the connection (e.g. main), paste the Client ID and the Client secret, enter your Account ID, select your Region, and click Connect.
5. Go to Access Review > Sources, click Add sources, tick 1Password, and click Add.

Probo names the source after your account ID and pulls the account’s members into your campaigns.

Option B: SCIM Bridge

1. In 1Password.com, signed in as an owner or administrator, select Integrations in the sidebar, open the Directory tab if 1Password shows one, then select your identity provider in the User Provisioning section.
2. Complete the provisioning setup. For provisioning hosted by 1Password, select Set up hosted provisioning. For a self-hosted bridge, choose your deployment platform and follow 1Password’s deployment guide for it.
3. Copy the bearer token that 1Password issues at the end of setup and store it securely. You deploy a self-hosted bridge with the scimsession file that 1Password generates together with the token, so keep both. A token from another 1Password integration, such as Events Reporting, does not work.
4. In Probo, go to Settings > Connectors and click Add more to open the Marketplace.
5. Find 1Password and open it.
6. Choose API key.
7. Enter a Name for the connection (e.g. main), paste the bearer token into API key, enter your SCIM Bridge URL (the address of the bridge that token was issued for, with no path), and click Connect.
8. Go to Access Review > Sources, click Add sources, tick 1Password, and click Add.

Probo names the source after your SCIM Bridge URL and pulls the account’s members into your campaigns.

Troubleshooting

Client Credentials

• Account ID rejected. Probo shows Could not connect when the account ID is not 26 letters and digits. Copy it from the address of the 1Password web app, not the sign-in address or the account name.
• The connector shows Disconnected. 1Password refused the client credentials. Confirm that the client ID and secret were copied whole, that the application still appears under Integrations > Your integrations, and that the region matches the ending of your sign-in address. 1Password serves each region from its own host, so credentials from one region are refused by the others.
• The connector shows Not authorized. 1Password accepted the client credentials but refused the user list. Either the application lacks the View users scope, or the Account ID is not your account’s, for example the client ID pasted in its place. Scopes cannot be changed, so for a missing scope create a new application with View users. In both cases, delete the source in Access Review > Sources, disconnect the connector in Settings > Connectors, and connect again.
• The client secret was rotated. After Rotate client secret on the application’s page, 1Password keeps the previous secret valid for 6 hours. Probo cannot take a new secret in place, so within that time delete the source in Access Review > Sources, disconnect the connector in Settings > Connectors, and connect again with the new secret.
• An invited member is missing. 1Password lists only active and suspended users, so a person appears once they have joined and been confirmed.
• No account is flagged as an administrator. The Users API reports no role, so Role and Admin stay empty for every member. Review who holds the owner and administrator roles in 1Password instead.

SCIM Bridge

• Token rejected. The bridge accepts only the bearer token paired with the scimsession file it runs with, so a token from an earlier setup or from a different 1Password integration fails. Selecting Regenerate Credentials on the 1Password Integrations page issues a new pair. Deploy a self-hosted bridge with the new scimsession file and give the new token to your identity provider, then click Update API key (the key icon) on the 1Password connector in Settings > Connectors, paste the new token, and click Save API key.
• No members appear. Probo lists the users the bridge returns on its /scim/v2/Users endpoint and skips any record without an email address. Confirm the bridge is healthy and that the URL you connected is the one your identity provider provisions against.
• SCIM Bridge URL rejected. The URL must use http or https and include a host, for example https://scim.example.com. Probo calls the bridge from its own servers, so you cannot connect a bridge that is reachable only on a private network.
• No account is flagged as an administrator. Probo reads no role from the SCIM user records, so Role and Admin stay empty for every member. Review who holds the owner and administrator roles in the 1Password console instead.
• The provisioning setup is unavailable. Automated user provisioning is a 1Password Business feature, and only an owner or an administrator can set it up. On a lower plan, upgrade first.