diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1c42b07f..6f693866 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,7 +36,7 @@ terraform {
   required_providers {
     onepassword = {
       source  = "1Password/onepassword"
-      version = "~> 1.3.0"
+      version = "~> 2.0.0"
     }
   }
 }
diff --git a/README.md b/README.md
index 20c19a5c..e09858d6 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ terraform {
   required_providers {
     onepassword = {
       source = "1Password/onepassword"
-      version = "~> 1.3.0"
+      version = "~> 2.0.0"
     }
   }
 }
diff --git a/docs/data-sources/item.md b/docs/data-sources/item.md
index 16012719..7877629e 100644
--- a/docs/data-sources/item.md
+++ b/docs/data-sources/item.md
@@ -14,8 +14,8 @@ Use this data source to get details of an item by its vault uuid and either the
 
 ```terraform
 data "onepassword_item" "example" {
-  vault = data.onepassword_vault.example.uuid
-  uuid  = onepassword_item.demo_sections.uuid
+  vault = "your-vault-id"
+  title = "your-item-title"
 }
 ```
 
@@ -34,9 +34,10 @@ data "onepassword_item" "example" {
 
 ### Read-Only
 
-- `category` (String) The category of the item. One of ["login" "password" "database" "secure_note"]
+- `category` (String) The category of the item. One of ["login" "password" "database" "secure_note" "document"]
 - `credential` (String, Sensitive) API credential for this item.
 - `database` (String) (Only applies to the database category) The name of the database.
+- `file` (Block List) A list of files attached to the item. (see [below for nested schema](#nestedblock--file))
 - `hostname` (String) (Only applies to the database category) The address where the database can be found
 - `id` (String) The Terraform resource identifier for this item in the format `vaults/<vault_id>/items/<item_id>`.
 - `password` (String, Sensitive) Password for this item.
@@ -47,12 +48,24 @@ data "onepassword_item" "example" {
 - `url` (String) The primary URL for the item.
 - `username` (String) Username for this item.
 
+<a id="nestedblock--file"></a>
+### Nested Schema for `file`
+
+Read-Only:
+
+- `content` (String, Sensitive) The content of the file.
+- `content_base64` (String, Sensitive) The content of the file in base64 encoding. (Use this for binary files.)
+- `id` (String) The UUID of the file.
+- `name` (String) The name of the file.
+
+
 <a id="nestedblock--section"></a>
 ### Nested Schema for `section`
 
 Read-Only:
 
 - `field` (Block List) (see [below for nested schema](#nestedblock--section--field))
+- `file` (Block List) A list of files attached to the section. (see [below for nested schema](#nestedblock--section--file))
 - `id` (String) A unique identifier for the section.
 - `label` (String) The label for the section.
 
@@ -63,6 +76,17 @@ Read-Only:
 
 - `id` (String) A unique identifier for the field.
 - `label` (String) The label for the field.
-- `purpose` (String) Purpose indicates this is a special field: a username, password, or notes field.
-- `type` (String) The type of value stored in the field.
+- `purpose` (String) Purpose indicates this is a special field: a username, password, or notes field. One of ["USERNAME" "PASSWORD" "NOTES"]
+- `type` (String) The type of value stored in the field. One of ["STRING" "CONCEALED" "EMAIL" "URL" "OTP" "DATE" "MONTH_YEAR" "MENU"]
 - `value` (String, Sensitive) The value of the field.
+
+
+<a id="nestedblock--section--file"></a>
+### Nested Schema for `section.file`
+
+Read-Only:
+
+- `content` (String, Sensitive) The content of the file.
+- `content_base64` (String, Sensitive) The content of the file in base64 encoding. (Use this for binary files.)
+- `id` (String) The UUID of the file.
+- `name` (String) The name of the file.
diff --git a/docs/data-sources/vault.md b/docs/data-sources/vault.md
index 6a0d590c..028cd6a9 100644
--- a/docs/data-sources/vault.md
+++ b/docs/data-sources/vault.md
@@ -14,7 +14,7 @@ Use this data source to get details of a vault by either its name or uuid.
 
 ```terraform
 data "onepassword_vault" "example" {
-  name = var.demo_vault
+  name = "your-vault-name"
 }
 ```
 
diff --git a/docs/resources/item.md b/docs/resources/item.md
index f1bc440e..5f812934 100644
--- a/docs/resources/item.md
+++ b/docs/resources/item.md
@@ -13,11 +13,11 @@ A 1Password Item.
 ## Example Usage
 
 ```terraform
-resource "onepassword_item" "demo_password" {
-  vault = var.demo_vault
+resource "onepassword_item" "example" {
+  vault = "your-vault-id"
 
-  title    = "Demo Password Recipe"
-  category = "password"
+  title    = "Example Item Title"
+  category = "login"
 
   password_recipe {
     length  = 40
@@ -25,36 +25,15 @@ resource "onepassword_item" "demo_password" {
   }
 
   section {
-    label = "Credential metadata"
+    label = "Example section"
 
     field {
-      label = "Expiration"
+      label = "Example field"
       type  = "DATE"
       value = "2024-01-31"
     }
   }
 }
-
-resource "onepassword_item" "demo_login" {
-  vault = var.demo_vault
-
-  title    = "Demo Terraform Login"
-  category = "login"
-  username = "test@example.com"
-}
-
-resource "onepassword_item" "demo_db" {
-  vault    = var.demo_vault
-  category = "database"
-  type     = "mysql"
-
-  title    = "Demo TF Database"
-  username = "root"
-
-  database = "Example MySQL Instance"
-  hostname = "localhost"
-  port     = 3306
-}
 ```
 
 <!-- schema generated by tfplugindocs -->
diff --git a/examples/data-sources/onepassword_item/data-source.tf b/examples/data-sources/onepassword_item/data-source.tf
index 37c3a317..7322cd91 100644
--- a/examples/data-sources/onepassword_item/data-source.tf
+++ b/examples/data-sources/onepassword_item/data-source.tf
@@ -1,4 +1,4 @@
 data "onepassword_item" "example" {
-  vault = data.onepassword_vault.example.uuid
-  uuid  = onepassword_item.demo_sections.uuid
+  vault = "your-vault-id"
+  title = "your-item-title"
 }
diff --git a/examples/data-sources/onepassword_vault/data-source.tf b/examples/data-sources/onepassword_vault/data-source.tf
index 275697cc..16c62c1c 100644
--- a/examples/data-sources/onepassword_vault/data-source.tf
+++ b/examples/data-sources/onepassword_vault/data-source.tf
@@ -1,3 +1,3 @@
 data "onepassword_vault" "example" {
-  name = var.demo_vault
+  name = "your-vault-name"
 }
\ No newline at end of file
diff --git a/examples/main.tf b/examples/item/main.tf
similarity index 63%
rename from examples/main.tf
rename to examples/item/main.tf
index 97dd05f5..b1a7dcb1 100644
--- a/examples/main.tf
+++ b/examples/item/main.tf
@@ -2,19 +2,37 @@ terraform {
   required_providers {
     onepassword = {
       source  = "1Password/onepassword"
-      version = "~> 1.3.0"
+      version = "~> 2.0.0"
     }
   }
 }
 
-provider "onepassword" {
-  url = "http://localhost:8080"
+data "onepassword_vault" "demo_vault" {
+  name = var.demo_vault
+}
+
+resource "onepassword_item" "demo_login" {
+  vault = data.onepassword_vault.demo_vault.uuid
+
+  title    = "Demo Terraform Login Item"
+  category = "login"
+  username = "test@example.com"
+
+  tags = ["Terraform", "Automation"]
+
+  password_recipe {
+    length  = 32
+    digits  = false
+    symbols = false
+  }
+
+  note_value = "An item created with the 1Password Terraform provider"
 }
 
 resource "onepassword_item" "demo_password" {
-  vault = var.demo_vault
+  vault = data.onepassword_vault.demo_vault.uuid
 
-  title    = "Demo Password Recipe"
+  title    = "Demo Terraform Password Item"
   category = "password"
 
   password_recipe {
@@ -33,20 +51,12 @@ resource "onepassword_item" "demo_password" {
   }
 }
 
-resource "onepassword_item" "demo_login" {
-  vault = var.demo_vault
-
-  title    = "Demo Terraform Login"
-  category = "login"
-  username = "test@example.com"
-}
-
 resource "onepassword_item" "demo_db" {
-  vault    = var.demo_vault
+  vault    = data.onepassword_vault.demo_vault.uuid
   category = "database"
   type     = "mysql"
 
-  title    = "Demo TF Database"
+  title    = "Demo Terraform Database Item"
   username = "root"
 
   database = "Example MySQL Instance"
@@ -54,8 +64,20 @@ resource "onepassword_item" "demo_db" {
   port     = 3306
 }
 
+resource "onepassword_item" "demo_secure_note" {
+  vault = data.onepassword_vault.demo_vault.uuid
+
+  title    = "Demo Terraform Secure Note Item"
+  category = "secure_note"
+
+  note_value = <<EOT
+  Welcome to the Terraform world! 🤩
+  This was an item created with the 1Password Terraform provider.
+  EOT
+}
+
 resource "onepassword_item" "demo_sections" {
-  vault = var.demo_vault
+  vault = data.onepassword_vault.demo_vault.uuid
 
   title    = "Demo Terraform Item with Sections"
   category = "login"
@@ -105,6 +127,6 @@ resource "onepassword_item" "demo_sections" {
 # Example of a Data Source Item with multiple sections and fields.
 # Uncomment it once the item above has been created to see an example of a Data Source
 # data "onepassword_item" "example" {
-#   vault = var.demo_vault
+#   vault = data.onepassword_vault.demo_vault.uuid
 #   uuid  = onepassword_item.demo_sections.uuid
 # }
diff --git a/examples/variable.tf b/examples/item/variable.tf
similarity index 100%
rename from examples/variable.tf
rename to examples/item/variable.tf
diff --git a/examples/resources/onepassword_item/resource.tf b/examples/resources/onepassword_item/resource.tf
index ecd349c7..387ce94f 100644
--- a/examples/resources/onepassword_item/resource.tf
+++ b/examples/resources/onepassword_item/resource.tf
@@ -1,8 +1,8 @@
-resource "onepassword_item" "demo_password" {
-  vault = var.demo_vault
+resource "onepassword_item" "example" {
+  vault = "your-vault-id"
 
-  title    = "Demo Password Recipe"
-  category = "password"
+  title    = "Example Item Title"
+  category = "login"
 
   password_recipe {
     length  = 40
@@ -10,33 +10,12 @@ resource "onepassword_item" "demo_password" {
   }
 
   section {
-    label = "Credential metadata"
+    label = "Example section"
 
     field {
-      label = "Expiration"
+      label = "Example field"
       type  = "DATE"
       value = "2024-01-31"
     }
   }
 }
-
-resource "onepassword_item" "demo_login" {
-  vault = var.demo_vault
-
-  title    = "Demo Terraform Login"
-  category = "login"
-  username = "test@example.com"
-}
-
-resource "onepassword_item" "demo_db" {
-  vault    = var.demo_vault
-  category = "database"
-  type     = "mysql"
-
-  title    = "Demo TF Database"
-  username = "root"
-
-  database = "Example MySQL Instance"
-  hostname = "localhost"
-  port     = 3306
-}
diff --git a/internal/onepassword/cli/op.go b/internal/onepassword/cli/op.go
index daca6583..d4fcc470 100644
--- a/internal/onepassword/cli/op.go
+++ b/internal/onepassword/cli/op.go
@@ -208,6 +208,20 @@ func (op *OP) delete(ctx context.Context, item *onepassword.Item, vaultUuid stri
 	return nil, op.execJson(ctx, nil, nil, p("item"), p("delete"), p(item.ID), f("vault", vaultUuid))
 }
 
+func (op *OP) GetFileContent(ctx context.Context, file *onepassword.File, itemUuid, vaultUuid string) ([]byte, error) {
+	versionErr := op.checkCliVersion(ctx)
+	if versionErr != nil {
+		return nil, versionErr
+	}
+	ref := fmt.Sprintf("op://%s/%s/%s", vaultUuid, itemUuid, file.ID)
+	tflog.Debug(ctx, "reading file content from: "+ref)
+	res, err := op.execRaw(ctx, nil, p("read"), p(ref))
+	if err != nil {
+		return nil, err
+	}
+	return res, nil
+}
+
 func (op *OP) execJson(ctx context.Context, dst any, stdin []byte, args ...opArg) error {
 	result, err := op.execRaw(ctx, stdin, args...)
 	if err != nil {
diff --git a/internal/onepassword/client.go b/internal/onepassword/client.go
index 5a50d9fb..0265bb12 100644
--- a/internal/onepassword/client.go
+++ b/internal/onepassword/client.go
@@ -18,6 +18,7 @@ type Client interface {
 	CreateItem(ctx context.Context, item *onepassword.Item, vaultUuid string) (*onepassword.Item, error)
 	UpdateItem(ctx context.Context, item *onepassword.Item, vaultUuid string) (*onepassword.Item, error)
 	DeleteItem(ctx context.Context, item *onepassword.Item, vaultUuid string) error
+	GetFileContent(ctx context.Context, file *onepassword.File, itemUUid, vaultUuid string) ([]byte, error)
 }
 
 type ClientConfig struct {
diff --git a/internal/onepassword/connect/connect_client.go b/internal/onepassword/connect/connect_client.go
index 26de26f2..f7a092d4 100644
--- a/internal/onepassword/connect/connect_client.go
+++ b/internal/onepassword/connect/connect_client.go
@@ -39,6 +39,10 @@ func (c *Client) DeleteItem(_ context.Context, item *onepassword.Item, vaultUuid
 	return c.connectClient.DeleteItem(item, vaultUuid)
 }
 
+func (w *Client) GetFileContent(_ context.Context, file *onepassword.File, itemUUID, vaultUUID string) ([]byte, error) {
+	return w.connectClient.GetFileContent(file)
+}
+
 func NewClient(connectHost, connectToken, providerUserAgent string) *Client {
 	return &Client{connectClient: connect.NewClientWithUserAgent(connectHost, connectToken, providerUserAgent)}
 }
diff --git a/internal/provider/const.go b/internal/provider/const.go
index 3aa83a8f..afae4b48 100644
--- a/internal/provider/const.go
+++ b/internal/provider/const.go
@@ -30,6 +30,14 @@ const (
 	sectionIDDescription     = "A unique identifier for the section."
 	sectionLabelDescription  = "The label for the section."
 	sectionFieldsDescription = "A list of custom fields in the section."
+	sectionFilesDescription  = "A list of files attached to the section."
+
+	filesDescription             = "A list of files attached to the item."
+	fileDescription              = "A file attached to the item."
+	fileIDDescription            = "The UUID of the file."
+	fileNameDescription          = "The name of the file."
+	fileContentDescription       = "The content of the file."
+	fileContentBase64Description = "The content of the file in base64 encoding. (Use this for binary files.)"
 
 	fieldDescription        = "A custom field."
 	fieldIDDescription      = "A unique identifier for the field."
@@ -59,6 +67,7 @@ var (
 		strings.ToLower(string(op.Database)),
 		strings.ToLower(string(op.SecureNote)),
 	}
+	dataSourceCategories = append(categories, strings.ToLower(string(op.Document)))
 
 	fieldPurposes = []string{
 		string(op.FieldPurposeUsername),
diff --git a/internal/provider/onepassword_item_data_source.go b/internal/provider/onepassword_item_data_source.go
index 3af3d272..9f98c534 100644
--- a/internal/provider/onepassword_item_data_source.go
+++ b/internal/provider/onepassword_item_data_source.go
@@ -2,6 +2,7 @@ package provider
 
 import (
 	"context"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"strings"
@@ -48,12 +49,21 @@ type OnePasswordItemDataSourceModel struct {
 	NoteValue  types.String                  `tfsdk:"note_value"`
 	Credential types.String                  `tfsdk:"credential"`
 	Section    []OnePasswordItemSectionModel `tfsdk:"section"`
+	File       []OnePasswordItemFileModel    `tfsdk:"file"`
+}
+
+type OnePasswordItemFileModel struct {
+	ID            types.String `tfsdk:"id"`
+	Name          types.String `tfsdk:"name"`
+	Content       types.String `tfsdk:"content"`
+	ContentBase64 types.String `tfsdk:"content_base64"`
 }
 
 type OnePasswordItemSectionModel struct {
 	ID    types.String                `tfsdk:"id"`
 	Label types.String                `tfsdk:"label"`
 	Field []OnePasswordItemFieldModel `tfsdk:"field"`
+	File  []OnePasswordItemFileModel  `tfsdk:"file"`
 }
 
 type OnePasswordItemFieldModel struct {
@@ -69,6 +79,29 @@ func (d *OnePasswordItemDataSource) Metadata(ctx context.Context, req datasource
 }
 
 func (d *OnePasswordItemDataSource) Schema(ctx context.Context, req datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	fileNestedObjectSchema := schema.NestedBlockObject{
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				MarkdownDescription: fileIDDescription,
+				Computed:            true,
+			},
+			"name": schema.StringAttribute{
+				MarkdownDescription: fileNameDescription,
+				Computed:            true,
+			},
+			"content": schema.StringAttribute{
+				MarkdownDescription: fileContentDescription,
+				Computed:            true,
+				Sensitive:           true,
+			},
+			"content_base64": schema.StringAttribute{
+				MarkdownDescription: fileContentBase64Description,
+				Computed:            true,
+				Sensitive:           true,
+			},
+		},
+	}
+
 	resp.Schema = schema.Schema{
 		// This description is used by the documentation generator and the language server.
 		MarkdownDescription: "Use this data source to get details of an item by its vault uuid and either the title or the uuid of the item.",
@@ -99,7 +132,7 @@ func (d *OnePasswordItemDataSource) Schema(ctx context.Context, req datasource.S
 				Computed:            true,
 			},
 			"category": schema.StringAttribute{
-				MarkdownDescription: fmt.Sprintf(enumDescription, categoryDescription, categories),
+				MarkdownDescription: fmt.Sprintf(enumDescription, categoryDescription, dataSourceCategories),
 				Computed:            true,
 			},
 			"url": schema.StringAttribute{
@@ -175,11 +208,11 @@ func (d *OnePasswordItemDataSource) Schema(ctx context.Context, req datasource.S
 										Computed:            true,
 									},
 									"purpose": schema.StringAttribute{
-										MarkdownDescription: fieldPurposeDescription,
+										MarkdownDescription: fmt.Sprintf(enumDescription, fieldPurposeDescription, fieldPurposes),
 										Computed:            true,
 									},
 									"type": schema.StringAttribute{
-										MarkdownDescription: fieldTypeDescription,
+										MarkdownDescription: fmt.Sprintf(enumDescription, fieldTypeDescription, fieldTypes),
 										Computed:            true,
 									},
 									"value": schema.StringAttribute{
@@ -190,9 +223,17 @@ func (d *OnePasswordItemDataSource) Schema(ctx context.Context, req datasource.S
 								},
 							},
 						},
+						"file": schema.ListNestedBlock{
+							MarkdownDescription: sectionFilesDescription,
+							NestedObject:        fileNestedObjectSchema,
+						},
 					},
 				},
 			},
+			"file": schema.ListNestedBlock{
+				MarkdownDescription: filesDescription,
+				NestedObject:        fileNestedObjectSchema,
+			},
 		},
 	}
 }
@@ -273,6 +314,26 @@ func (d *OnePasswordItemDataSource) Read(ctx context.Context, req datasource.Rea
 			}
 		}
 
+		for _, f := range item.Files {
+			if f.Section != nil && f.Section.ID == s.ID {
+				content, err := f.Content()
+				if err != nil {
+					// content has not yet been loaded, fetch it
+					content, err = d.client.GetFileContent(ctx, f, item.ID, item.Vault.ID)
+				}
+				if err != nil {
+					resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to read file, got error: %s", err))
+				}
+				file := OnePasswordItemFileModel{
+					ID:            types.StringValue(f.ID),
+					Name:          types.StringValue(f.Name),
+					Content:       types.StringValue(string(content)),
+					ContentBase64: types.StringValue(base64.StdEncoding.EncodeToString(content)),
+				}
+				section.File = append(section.File, file)
+			}
+		}
+
 		data.Section = append(data.Section, section)
 	}
 
@@ -308,6 +369,25 @@ func (d *OnePasswordItemDataSource) Read(ctx context.Context, req datasource.Rea
 		}
 	}
 
+	for _, f := range item.Files {
+		if f.Section == nil {
+			content, err := f.Content()
+			if err != nil {
+				// content has not yet been loaded, fetch it
+				content, err = d.client.GetFileContent(ctx, f, item.ID, item.Vault.ID)
+			}
+			if err != nil {
+				resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to read file, got error: %s", err))
+			}
+			file := OnePasswordItemFileModel{
+				ID:            types.StringValue(f.ID),
+				Name:          types.StringValue(f.Name),
+				Content:       types.StringValue(string(content)),
+				ContentBase64: types.StringValue(base64.StdEncoding.EncodeToString(content)),
+			}
+			data.File = append(data.File, file)
+		}
+	}
 	// Write logs using the tflog package
 	// Documentation: https://terraform.io/plugin/log
 	tflog.Trace(ctx, "read an item data source")
diff --git a/internal/provider/onepassword_item_data_source_test.go b/internal/provider/onepassword_item_data_source_test.go
index fc5d8543..af2d3113 100644
--- a/internal/provider/onepassword_item_data_source_test.go
+++ b/internal/provider/onepassword_item_data_source_test.go
@@ -1,6 +1,7 @@
 package provider
 
 import (
+	"encoding/base64"
 	"fmt"
 	"strings"
 	"testing"
@@ -138,6 +139,94 @@ func TestAccItemPasswordDatabase(t *testing.T) {
 	})
 }
 
+func TestAccItemDocument(t *testing.T) {
+	expectedItem := generateDocumentItem()
+	expectedVault := op.Vault{
+		ID:          expectedItem.Vault.ID,
+		Name:        "Name of the vault",
+		Description: "This vault will be retrieved",
+	}
+
+	testServer := setupTestServer(expectedItem, expectedVault, t)
+	defer testServer.Close()
+
+	first_content, err := expectedItem.Files[0].Content()
+	if err != nil {
+		t.Fatalf("Error getting content of first file: %v", err)
+	}
+
+	second_content, err := expectedItem.Files[1].Content()
+	if err != nil {
+		t.Fatalf("Error getting content of second file: %v", err)
+	}
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProviderConfig(testServer.URL) + testAccItemDataSourceConfig(expectedItem.Vault.ID, expectedItem.ID),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "id", fmt.Sprintf("vaults/%s/items/%s", expectedVault.ID, expectedItem.ID)),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "vault", expectedVault.ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "title", expectedItem.Title),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "uuid", expectedItem.ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "category", strings.ToLower(string(expectedItem.Category))),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "file.0.id", expectedItem.Files[0].ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "file.0.name", expectedItem.Files[0].Name),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "file.0.content", string(first_content)),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "file.1.id", expectedItem.Files[1].ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "file.1.name", expectedItem.Files[1].Name),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "file.1.content_base64", base64.StdEncoding.EncodeToString(second_content)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccItemLoginWithFiles(t *testing.T) {
+	expectedItem := generateLoginItemWithFiles()
+	expectedVault := op.Vault{
+		ID:          expectedItem.Vault.ID,
+		Name:        "Name of the vault",
+		Description: "This vault will be retrieved",
+	}
+
+	testServer := setupTestServer(expectedItem, expectedVault, t)
+	defer testServer.Close()
+
+	first_content, err := expectedItem.Files[0].Content()
+	if err != nil {
+		t.Fatalf("Error getting content of first file: %v", err)
+	}
+
+	second_content, err := expectedItem.Files[1].Content()
+	if err != nil {
+		t.Fatalf("Error getting content of second file: %v", err)
+	}
+
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProviderConfig(testServer.URL) + testAccItemDataSourceConfig(expectedItem.Vault.ID, expectedItem.ID),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "id", fmt.Sprintf("vaults/%s/items/%s", expectedVault.ID, expectedItem.ID)),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "vault", expectedVault.ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "title", expectedItem.Title),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "uuid", expectedItem.ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "category", strings.ToLower(string(expectedItem.Category))),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "section.0.file.0.id", expectedItem.Files[0].ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "section.0.file.0.name", expectedItem.Files[0].Name),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "section.0.file.0.content", string(first_content)),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "section.0.file.1.id", expectedItem.Files[1].ID),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "section.0.file.1.name", expectedItem.Files[1].Name),
+					resource.TestCheckResourceAttr("data.onepassword_item.test", "section.0.file.1.content_base64", base64.StdEncoding.EncodeToString(second_content)),
+				),
+			},
+		},
+	})
+}
+
 func testAccItemDataSourceConfig(vault, uuid string) string {
 	return fmt.Sprintf(`
 data "onepassword_item" "test" {
diff --git a/internal/provider/onepassword_item_resource.go b/internal/provider/onepassword_item_resource.go
index 79682010..4f6096fb 100644
--- a/internal/provider/onepassword_item_resource.go
+++ b/internal/provider/onepassword_item_resource.go
@@ -213,6 +213,7 @@ func (r *OnePasswordItemResource) Schema(ctx context.Context, req resource.Schem
 				Optional:            true,
 				Computed:            true,
 				Sensitive:           true,
+				//Default:             stringdefault.StaticString(""),
 				PlanModifiers: []planmodifier.String{
 					ValueModifier(),
 				},
@@ -337,6 +338,7 @@ func (r *OnePasswordItemResource) Create(ctx context.Context, req resource.Creat
 	createdItem, err := r.client.CreateItem(ctx, item, item.Vault.ID)
 	if err != nil {
 		resp.Diagnostics.AddError("1Password Item create error", fmt.Sprintf("Error creating 1Password item, got error %s", err))
+		return
 	}
 
 	resp.Diagnostics.Append(itemToData(ctx, createdItem, &data)...)
@@ -603,6 +605,10 @@ func itemToData(ctx context.Context, item *op.Item, data *OnePasswordItemResourc
 		}
 	}
 
+	if item.Category == op.SecureNote && data.Password.IsUnknown() {
+		data.Password = types.StringNull()
+	}
+
 	return nil
 }
 
diff --git a/internal/provider/onepassword_item_resource_test.go b/internal/provider/onepassword_item_resource_test.go
index 60a4975b..896b77e3 100644
--- a/internal/provider/onepassword_item_resource_test.go
+++ b/internal/provider/onepassword_item_resource_test.go
@@ -2,6 +2,7 @@ package provider
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -119,6 +120,7 @@ func TestAccItemResourceSecureNote(t *testing.T) {
 					resource.TestCheckResourceAttr("onepassword_item.test-secure-note", "title", expectedItem.Title),
 					resource.TestCheckResourceAttr("onepassword_item.test-secure-note", "category", strings.ToLower(string(expectedItem.Category))),
 					resource.TestCheckResourceAttr("onepassword_item.test-secure-note", "note_value", expectedItem.Fields[0].Value),
+					resource.TestCheckNoResourceAttr("onepassword_item.test-secure-note", "password"),
 				),
 			},
 		},
@@ -155,12 +157,34 @@ func TestAccItemResourceWithSections(t *testing.T) {
 	})
 }
 
+func TestAccItemResourceDocument(t *testing.T) {
+	expectedItem := generateDocumentItem()
+	expectedVault := op.Vault{
+		ID:          expectedItem.Vault.ID,
+		Name:        "VaultName",
+		Description: "This vault will be retrieved for testing",
+	}
+
+	testServer := setupTestServer(expectedItem, expectedVault, t)
+	defer testServer.Close()
+
+	resource.UnitTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccProviderConfig(testServer.URL) + testAccDocumentResourceConfig(expectedItem),
+				ExpectError: regexp.MustCompile("Invalid Attribute Value Match"),
+			},
+		},
+	})
+}
+
 func testAccDataBaseResourceConfig(expectedItem *op.Item) string {
 	return fmt.Sprintf(`
 
 data "onepassword_vault" "acceptance-tests" {
 	uuid = "%s"
-}	
+}
 resource "onepassword_item" "test-database" {
   vault = data.onepassword_vault.acceptance-tests.uuid
   title = "%s"
@@ -179,7 +203,7 @@ func testAccPasswordResourceConfig(expectedItem *op.Item) string {
 
 data "onepassword_vault" "acceptance-tests" {
 	uuid = "%s"
-}	
+}
 resource "onepassword_item" "test-database" {
   vault = data.onepassword_vault.acceptance-tests.uuid
   title = "%s"
@@ -221,6 +245,19 @@ EOT
 }`, expectedItem.Vault.ID, expectedItem.Title, strings.ToLower(string(expectedItem.Category)), strings.TrimSuffix(expectedItem.Fields[0].Value, "\n"))
 }
 
+func testAccDocumentResourceConfig(expectedItem *op.Item) string {
+	return fmt.Sprintf(`
+
+data "onepassword_vault" "acceptance-tests" {
+	uuid = "%s"
+}
+resource "onepassword_item" "test-document" {
+  vault = data.onepassword_vault.acceptance-tests.uuid
+  title = "%s"
+  category = "%s"
+}`, expectedItem.Vault.ID, expectedItem.Title, strings.ToLower(string(expectedItem.Category)))
+}
+
 func testAccResourceWithSectionsConfig(expectedItem *op.Item) string {
 	return fmt.Sprintf(`
 
diff --git a/internal/provider/test_http_server.go b/internal/provider/test_http_server.go
index 9dad7c65..162fa7a7 100644
--- a/internal/provider/test_http_server.go
+++ b/internal/provider/test_http_server.go
@@ -6,6 +6,9 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"regexp"
+	"slices"
+	"strings"
 	"testing"
 
 	"github.com/1Password/connect-sdk-go/onepassword"
@@ -18,6 +21,16 @@ func setupTestServer(expectedItem *onepassword.Item, expectedVault onepassword.V
 		t.Errorf("error marshaling item for testing: %s", err)
 	}
 
+	files := expectedItem.Files
+	var fileBytes [][]byte
+	for _, file := range files {
+		c, err := file.Content()
+		if err != nil {
+			t.Errorf("error getting file content: %s", err)
+		}
+		fileBytes = append(fileBytes, c)
+	}
+
 	vaultBytes, err := json.Marshal(expectedVault)
 	if err != nil {
 		t.Errorf("error marshaling vault for testing: %s", err)
@@ -30,6 +43,7 @@ func setupTestServer(expectedItem *onepassword.Item, expectedVault onepassword.V
 	}
 
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		filePath := regexp.MustCompile("/v1/vaults/[a-z0-9]*/items/[a-z0-9]*/files/[a-z0-9]*/content")
 		if r.Method == http.MethodGet {
 			if r.URL.String() == fmt.Sprintf("/v1/vaults/%s/items/%s", expectedItem.Vault.ID, expectedItem.ID) {
 				// Mock returning an item specified by uuid
@@ -53,17 +67,32 @@ func setupTestServer(expectedItem *onepassword.Item, expectedVault onepassword.V
 				if err != nil {
 					t.Errorf("error writing body: %s", err)
 				}
+			} else if filePath.MatchString(r.URL.String()) {
+				w.Header().Set("Content-Type", "application/json")
+				w.Header().Set("1Password-Connect-Version", "1.3.0") // must be >= 1.3.0
+				i := slices.IndexFunc(files, func(f *onepassword.File) bool {
+					return f.ID == strings.Split(r.URL.Path, "/")[7]
+				})
+				if i == -1 {
+					t.Errorf("file not found")
+				}
+				_, err := w.Write(fileBytes[i])
+				if err != nil {
+					t.Errorf("error writing body: %s", err)
+				}
 			} else {
 				t.Errorf("Unexpected request: %s Consider adding this endpoint to the test server", r.URL.String())
 			}
 		} else if r.Method == http.MethodPost {
 			if r.URL.String() == fmt.Sprintf("/v1/vaults/%s/items", expectedItem.Vault.ID) {
 				itemToReturn := convertBodyToItem(r, t)
-				itemField := onepassword.ItemField{
-					Label: "password",
-					Value: "somepassword",
+				if itemToReturn.Category != onepassword.SecureNote {
+					itemField := onepassword.ItemField{
+						Label: "password",
+						Value: "somepassword",
+					}
+					itemToReturn.Fields = append(itemToReturn.Fields, &itemField)
 				}
-				itemToReturn.Fields = append(itemToReturn.Fields, &itemField)
 
 				itemToReturn.ID = expectedItem.ID
 				itemBytes, err := json.Marshal(itemToReturn)
diff --git a/internal/provider/test_utils.go b/internal/provider/test_utils.go
index ed721a1f..22446c75 100644
--- a/internal/provider/test_utils.go
+++ b/internal/provider/test_utils.go
@@ -1,6 +1,10 @@
 package provider
 
-import "github.com/1Password/connect-sdk-go/onepassword"
+import (
+	"fmt"
+
+	"github.com/1Password/connect-sdk-go/onepassword"
+)
 
 func generateBaseItem() onepassword.Item {
 	item := onepassword.Item{}
@@ -80,6 +84,51 @@ notes
 	return &item
 }
 
+func generateDocumentItem() *onepassword.Item {
+	item := generateBaseItem()
+	item.Category = onepassword.Document
+	item.Files = []*onepassword.File{
+		{
+			ID:          "ascii",
+			Name:        "ascii",
+			ContentPath: fmt.Sprintf("/v1/vaults/%s/items/%s/files/%s/content", item.Vault.ID, item.ID, "ascii"),
+		},
+		{
+			ID:          "binary",
+			Name:        "binary",
+			ContentPath: fmt.Sprintf("/v1/vaults/%s/items/%s/files/%s/content", item.Vault.ID, item.ID, "binary"),
+		},
+	}
+	item.Files[0].SetContent([]byte("ascii"))
+	item.Files[1].SetContent([]byte{0xDE, 0xAD, 0xBE, 0xEF})
+
+	return &item
+}
+
+func generateLoginItemWithFiles() *onepassword.Item {
+	item := generateItemWithSections()
+	item.Category = onepassword.Login
+	section := item.Sections[0]
+	item.Files = []*onepassword.File{
+		{
+			ID:          "ascii",
+			Name:        "ascii",
+			Section:     section,
+			ContentPath: fmt.Sprintf("/v1/vaults/%s/items/%s/files/%s/content", item.Vault.ID, item.ID, "ascii"),
+		},
+		{
+			ID:          "binary",
+			Name:        "binary",
+			Section:     section,
+			ContentPath: fmt.Sprintf("/v1/vaults/%s/items/%s/files/%s/content", item.Vault.ID, item.ID, "binary"),
+		},
+	}
+	item.Files[0].SetContent([]byte("ascii"))
+	item.Files[1].SetContent([]byte{0xDE, 0xAD, 0xBE, 0xEF})
+
+	return item
+}
+
 func generateDatabaseFields() []*onepassword.ItemField {
 	fields := []*onepassword.ItemField{
 		{