1Password Solution 3.0.5+ — reverting to time-window polling silently drops itemusages events #15425

Describe the bug

The 1Password CCP data connector stopped delivering itemusages events after the 3.0.5 polling change. The signinattempts and auditevents feeds are unaffected.

Per the solution's own ReleaseNotes:

• 3.0.3 (06-07-2026) moved to cursor-based PersistentToken polling "so late-synced item usage events (e.g. reveal, secure-copy) are no longer dropped"
• 3.0.5 (06-08-2026) reverted to time-window NextPageToken polling to stop duplicate ingestion introduced by 3.0.3

The revert reintroduced the exact behaviour 3.0.3 fixed. The affected actions are the ones named in 3.0.3: reveal and secure-copy.

3.0.6 (29-09-2026) does not address this. It fixes DCR streamDeclarations and field mapping only, and the symptom persists on 3.0.6.

Observed impact

In one tenant running 3.0.6, over a 21 day window: 8 itemusages rows against 3,099 signinattempts rows, with 13 of the 21 days recording zero item usage. Before 3.0.5 the same tenant averaged roughly 21 item usage events per week. Onset coincided with the 3.0.5 rollout.

Because 1Password item usage is the only record of which credential a user actually read, losing it removes the audit trail that matters most for incident response and access review, while the connector continues to appear healthy. Sign-in volume stays normal, so there is no obvious signal that anything is wrong.

To Reproduce

1. Deploy the 1Password solution at 3.0.5 or later.
2. Ensure the 1Password Events Reporting token includes the Item usages scope.
3. Generate item usage activity (reveal, secure-copy) in 1Password.
4. Compare itemusages row counts in OnePasswordEventLogs_CL against signinattempts over the same period.

Likely shared root cause

This appears to be the inverse of #15207, where PersistentToken pagination on the Atlassian REST API poller causes large-scale duplicate ingestion. The two issues look like the same framework trade-off seen from opposite sides: cursor-based pagination replays pages, time-window pagination drops late-arriving events. Connector maintainers currently have to choose which defect to ship.

Expected behaviour

A polling strategy that neither drops late-synced events nor replays pages, for example cursor-based pagination combined with server-side deduplication or watermarking on event UUID.

🤖 Generated with Claude Code