secrets.resolve_all includes archived items

Scenario & Reproduction Steps

By default secrets.resolve works as expected (ignores archived records with the same name), but resolve_all seems to include archived items.

Setup:

Create an API user with appropriate permissions needed for this and put appropriate token in .env file
Create a vault with two records in it, one named Bug_ArchivedItems and one named Bug_noArchivedItems and for the username put test_user in both records.
run the code that is below, the expected results happen, you get both values correctly.
archive the record named Bug_ArchivedItems.
create a new record with the name Bug_ArchivedItems, add in the username of test_user and save it
re-run below code and you will now get an error type=<ResolveReferenceErrorTypes.TOO_MANY_ITEMS: 'tooManyItems'>

Code to reproduce (please excuse the terrible code, I just cobbled pieces together from an existing project to reference in this issue but hopefully it's enough). Standard resolve seems to ignore archived items by default but resolve_all does not.

from onepassword.client import Client as onepass # type: ignore
import os, asyncio, dotenv, asyncio # type: ignore

dotenv.load_dotenv()

async def main(data):
    optoken = os.getenv("OP_SERVICE_ACCOUNT_TOKEN")
    opclient = await onepass.authenticate(auth=optoken, integration_name="my name", integration_version="0.0.1")
    secrets = await opclient.secrets.resolve_all(data)
    for k, v in secrets.individual_responses.items():
        if v.error:
            print(f"{k}: {v.error}")
        else:
            print(f"{k}: {v.content.secret}")

asyncio.run(main(["op://opi/Bug_noArchivedItems/username"]))

asyncio.run(main(["op://opi/Bug_ArchivedItems/username"]))

Actual Behavior

op://opi/Bug_noArchivedItems/username: test_user
op://opi/Bug_ArchivedItems/username: type=<ResolveReferenceErrorTypes.TOO_MANY_ITEMS: 'tooManyItems'>

Expected Behavior

op://opi/Bug_noArchivedItems/username: test_user
op://opi/Bug_ArchivedItems/username: test_user

SDK version

onepassword-sdk 0.3.1

Additional information

Ideally they should behave the same, or at the very least we should have a documented option to make them work the same.

@mg-oerp

Hi @mg-oerp,

Thank you for raising this bug and sharing clear, repeatable steps to reproduce. I've been able to reproduce this bug and will make sure it gets noted within our team.

Thanks!

@moward98

Thanks @moward98

Any idea if/when we might see an update? I'm chewing through my 1000 calls/hour in record time while testing my app ;)

@moward98

Checking in again @moward98 , this is very critical for us. I'm thinking maybe I need to move to a different solution because I cannot finish dev work due to not having enough hourly requests due to this issue.

Theres even bugs in the rate limiting message so I have no idea how long I have to wait to connect again: not the missing amount of time. Very disappointed in this integration. I can't ask our devs to be using this so maybe we need to find a better solution.

[ERROR] 2025/10/07 14:35:48 Too many requests. Your client has been rate-limited. Try again in seconds

@moward98

2025-11-03 17:09:41,748 - uvicorn - INFO - Error message: [ERROR] 2025/11/03 17:09:41 could not read secret 'op://opi/inventory/notes': could not get item opi/inventory: Too many requests. Your client has been rate-limited. Try again in seconds

We're drowning over here. @moward98 is there a fix coming for this anytime soon? I guess maybe I will reach out an open a ticket through our 1password account, maybe it will get more traction?

@mg-oerp

Hi @mg-oerp - could you please submit a support request over at support@onepassword.com? PLease reference that you are getting inconsistent results from the SDK and also please mention that you are hitting the rate limit.

Please include a link to this ticket, your account (either a domain or primary email) in that email as well. It'll help us reproduce the issue. Thanks ~Phil

Hi @mg-oerp - could you please submit a support request over at support@onepassword.com? PLease reference that you are getting inconsistent results from the SDK and also please mention that you are hitting the rate limit.

Please include a link to this ticket, your account (either a domain or primary email) in that email as well. It'll help us reproduce the issue. Thanks ~Phil

Thanks Phil, will do. I've already got an open ticket going so I will include this information again.

@Gerk

Hi @Gerk and @mg-oerp,

Just to get a quick update for you. The team is aware of this issue and there is a fix in process and I don't have an exact ETA just yet, but please keep an eye out for updates in the near future.

Thanks for your patience and I'll try to post updates back here soon.
Phil

@Gerk

Hi @Gerk, happy to report that release 0.3.2 should fix your issue. You can quickly test with this script I put together:

import asyncio
import os

from onepassword import *

async def main():
    token = os.getenv("OP_SERVICE_ACCOUNT_TOKEN")

    client = await Client.authenticate(
        auth=token,
        integration_name="My 1Password Integration",
        integration_version="v1.0.0",
    )
    vaults = await client.vaults.list()

    to_create = ItemCreateParams(
        title="SuperWeirdUniqueName4",
        category=ItemCategory.LOGIN,
        vault_id=vaults[0].id,
        fields=[
            ItemField(
                id="username",
                title="username",
                field_type=ItemFieldType.TEXT,
                value="mynameisjeff",
            ),
        ],
        websites=[
            Website(
                label="my custom website",
                url="https://example.com",
                autofill_behavior=AutofillBehavior.NEVER,
            )
        ],
    )

    # create two items with the same name
    created_item_1 = await client.items.create(to_create)
    created_item_2 = await client.items.create(to_create)

    # this returns an error, because the secret reference is ambiguous
    secrets = await client.secrets.resolve_all(["op://{}/SuperWeirdUniqueName4/username".format(vaults[0].id)])
    print(secrets.individual_responses["op://{}/SuperWeirdUniqueName4/username".format(vaults[0].id)].error)

    await client.items.archive(vaults[0].id, created_item_1.id)

    # this no longer returns an error, because the secret reference is now unique after archiving one of the items
    secrets = await client.secrets.resolve_all(["op://{}/SuperWeirdUniqueName4/username".format(vaults[0].id)])
    print(secrets.individual_responses["op://{}/SuperWeirdUniqueName4/username".format(vaults[0].id)].content.secret)

if __name__ == "__main__":
    asyncio.run(main())

I am going to be closing this issue, but do reopen in case the latest release does not address your problem! 😄

@mg-oerp

cc: @mg-oerp (Please see @hculea 's message above :D)

@eusef

I will test today and re-open if the issue persists, thanks @eusef for pushing this one along.

Navigation Menu

Repository navigation

secrets.resolve_all includes archived items #180

Scenario & Reproduction Steps

Actual Behavior

Expected Behavior

SDK version

Additional information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

secrets.resolve_all includes archived items #180

Description

Scenario & Reproduction Steps

Actual Behavior

Expected Behavior

SDK version

Additional information

Activity

moward98 commented on Sep 24, 2025

mg-oerp commented on Oct 2, 2025

mg-oerp commented on Oct 7, 2025

mg-oerp commented on Oct 7, 2025

mg-oerp commented on Nov 3, 2025

eusef commented on Nov 3, 2025

Gerk commented on Nov 3, 2025

eusef commented on Nov 4, 2025

hculea commented on Nov 5, 2025

eusef commented on Nov 5, 2025

mg-oerp commented on Nov 5, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions