While 1Password Business provides excellent team and vault management, I've found its built-in reporting for administrative oversight to be somewhat limited, particularly for generating periodic, structured health reports for non-technical stakeholders. Management often requires visibility into adoption, item distribution, and potential risk areas without logging into the admin console.
To address this, I've developed a Python script that leverages the 1Password CLI and the Python SDK to extract, transform, and load vault metadata into a structured format suitable for reporting. The core of the script performs a series of API calls to enumerate vaults, items, and user associations, then aggregates the data into key metrics.
```python
#!/usr/bin/env python3
"""
1Password Vault Health Report Generator.
Exports key metrics to CSV for further analysis in BI tools.
Requires: op-connect, python >=3.8, op Python SDK.
"""
import csv
from datetime import datetime
from op import OnePasswordClient
def generate_vault_report(account_url='my.1password.com'):
with OnePasswordClient(account_url=account_url) as client:
vaults = client.vaults.list()
report_data = []
for vault in vaults:
items = client.items.list(vault_id=vault.id)
active_members = len(vault.members)
items_without_attachments = sum(1 for item in items if not item.files)
report_data.append({
'vault_name': vault.name,
'item_count': len(items),
'member_count': active_members,
'items_per_member': len(items) / active_members if active_members > 0 else 0,
'items_wo_attachments': items_without_attachments,
'last_updated': vault.updated_at.date() if vault.updated_at else 'N/A'
})
return report_data
if __name__ == "__main__":
data = generate_vault_report()
timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
filename = f'1password_vault_health_{timestamp}.csv'
with open(filename, 'w', newline='') as csvfile:
fieldnames = data[0].keys()
writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
writer.writeheader()
writer.writerows(data)
print(f"Report generated: {filename}")
```
The script outputs a CSV file with the following key dimensions, which I've found most actionable for management reviews:
* **Vault Name & Item Count**: Baseline inventory.
* **Member Count & Items per Member**: Identifies underutilized vaults or potential knowledge silos.
* **Items Without Attachments**: A crude but useful proxy for item completeness; items with attachments often indicate shared documents or secure notes.
* **Last Updated Date**: Surfaces stale vaults that may contain deprecated credentials.
In my environment, running this weekly and loading the results into a simple BigQuery table has enabled us to create dashboards that track trends in vault sprawl and guide our cleanup efforts. The primary cost consideration is API usage, but at our scale (~50 vaults, 5000 items), it's negligible. For larger deployments, I would recommend implementing a caching layer to avoid redundant `list` calls.
I'm interested to hear how others are approaching programmatic oversight of their 1Password deployments. Have you built similar tooling, and if so, what additional metrics did you find valuable for operational health?
--DC
data is the product