diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 69f5f4dd..f56be53d 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.135.0"
+  ".": "0.136.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee0b07e0..62965155 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.136.0](https://github.com/kernel/kernel-python-sdk/compare/v0.135.0...v0.136.0) (2026-10-28)
+
+
+### Features
+
+* Import approved 1Password logins onto stored-token credentials ([279faa3](https://github.com/kernel/kernel-python-sdk/commit/279faa380ab039e8dea75b553cae18d70157bf7c))
+
 ## [0.135.0](https://github.com/kernel/kernel-python-sdk/compare/v0.134.0...v0.135.0) (2026-10-28)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index a1eef8ba..a1f90afe 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.135.0"
+version = "0.136.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/src/kernel/_version.py b/src/kernel/_version.py
index 67655316..42db1fdd 100644
--- a/src/kernel/_version.py
+++ b/src/kernel/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.135.0"  # x-release-please-version
+__version__ = "0.136.0"  # x-release-please-version
diff --git a/src/kernel/types/vaults/one_password_credential_vault_item_spec.py b/src/kernel/types/vaults/one_password_credential_vault_item_spec.py
index 84811174..7566b72f 100644
--- a/src/kernel/types/vaults/one_password_credential_vault_item_spec.py
+++ b/src/kernel/types/vaults/one_password_credential_vault_item_spec.py
@@ -19,6 +19,12 @@ class RequestsEntry(BaseModel):
     type: str
     """Must be login."""
 
+    id: Optional[str] = None
+    """1Password's ID for this entry in an access request you created.
+
+    Supply it only with resolved.
+    """
+
     keywords: Optional[List[str]] = None
 
     reason: Optional[str] = None
diff --git a/src/kernel/types/vaults/one_password_credential_vault_item_spec_input_param.py b/src/kernel/types/vaults/one_password_credential_vault_item_spec_input_param.py
index 3a2b4c19..5a038695 100644
--- a/src/kernel/types/vaults/one_password_credential_vault_item_spec_input_param.py
+++ b/src/kernel/types/vaults/one_password_credential_vault_item_spec_input_param.py
@@ -9,7 +9,13 @@
 from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
 
-__all__ = ["OnePasswordCredentialVaultItemSpecInputParam", "Requests", "RequestsEntry", "RequestsEntryParameters"]
+__all__ = [
+    "OnePasswordCredentialVaultItemSpecInputParam",
+    "Requests",
+    "RequestsEntry",
+    "RequestsEntryParameters",
+    "Resolved",
+]
 
 
 class RequestsEntryParameters(TypedDict, total=False):
@@ -22,6 +28,12 @@ class RequestsEntry(TypedDict, total=False):
     type: Required[str]
     """Must be login."""
 
+    id: str
+    """1Password's ID for this entry in an access request you created.
+
+    Supply it only with resolved.
+    """
+
     keywords: SequenceNotStr[str]
 
     reason: str
@@ -41,13 +53,31 @@ class Requests(TypedDict, total=False):
     goal: str
 
 
+class Resolved(TypedDict, total=False):
+    reference: Required[str]
+    """1Password credential reference.
+
+    Pass it unchanged as resourcePath to the extension's fillCredential or to the
+    1Password SDK.
+    """
+
+    entry_id: Annotated[str, PropertyInfo(alias="entryId")]
+    """The requested entry this login satisfies, when known."""
+
+
 class OnePasswordCredentialVaultItemSpecInputParam(TypedDict, total=False):
     """
-    A login request backed by a connected 1Password account or by a customer-supplied access token and matching integration key. Supply either account or both secrets, never both. Supplied secrets are write-only and never returned. Supply requests for new items; website remains supported for existing account-backed callers.
+    A login request backed by a connected 1Password account or by a customer-supplied access token and matching integration key. Supply either account or both secrets, never both. Supplied secrets are write-only and never returned. Supply requests for new items; website remains supported for existing account-backed callers. To use an access request you already created and the user approved with the same access token and integration key, also supply access_request_id, resolved, and each requests entry's id; the item is created ready and Kernel doesn't create an access request.
     """
 
     provider: Required[Literal["1password"]]
 
+    access_request_id: str
+    """
+    ID of an approved access request you created with this access_token and
+    integration_key. Requires resolved.
+    """
+
     access_token: str
     """Customer-supplied 1Password broker token.
 
@@ -80,5 +110,13 @@ class OnePasswordCredentialVaultItemSpecInputParam(TypedDict, total=False):
     A credential item may request up to five login entries.
     """
 
+    resolved: Iterable[Resolved]
+    """
+    Granted logins from 1Password's status for access_request_id, as returned by the
+    1Password SDK or extension. Requires access_request_id and an id on every
+    requests entry. entryId may be omitted only when requests has one entry. Kernel
+    doesn't verify the references; 1Password checks them when filling.
+    """
+
     website: str
     """Legacy single-login shorthand. Supply requests instead."""