> ## Documentation Index > Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt > Use this file to discover all available pages before exploring further. # Update an offboarding access selection intent > Change which leaver accounts an access selection removes, before it executes; read the current proposal with `getOffboardingAccessSelectionIntent`. `idps` and `apps` are each replaced whole; null leaves a list as it is. `idps` are the email provider accounts (Google Workspace, Microsoft 365): what happens to the account (`accountAction`) and who receives its files and emails; `apps` are the other SaaS accounts. An entry with `selected: false` is kept. From `getEmployeeSaasIdentities` of the leaver: `saasId` is the `companySaasApplicationId`, `identityId` the `saasApplicationUserId`. Only the fields you send change. Refused with `INTENT_NOT_FOUND`, `INTENT_ALREADY_EXECUTED` once executed, `TICKET_CLOSED` when its task is completed or cancelled, `EXECUTION_IN_PROGRESS`, `ACCOUNT_NOT_HELD_BY_LEAVER`, `IDP_NOT_EMAIL_PROVIDER`, `APP_IS_EMAIL_PROVIDER`, `DEPROVISIONING_STRATEGY_NOT_AVAILABLE`, `TRANSFER_TARGET_NOT_FOUND`. Key: WriteScope: Company ## OpenAPI ````yaml https://api.getprimo.com/openapi.json patch /offboarding-access-selection-intents/{intentId} openapi: 3.1.1 info: title: Public API - BETA description: Read docs on https://docs.getprimo.com/ version: '1.0' contact: {} servers: - url: https://api.getprimo.com security: - apikey: [] tags: [] paths: /offboarding-access-selection-intents/{intentId}: patch: tags: - Offboardings summary: Update an offboarding access selection intent description: >- Change which leaver accounts an access selection removes, before it executes; read the current proposal with `getOffboardingAccessSelectionIntent`. `idps` and `apps` are each replaced whole; null leaves a list as it is. `idps` are the email provider accounts (Google Workspace, Microsoft 365): what happens to the account (`accountAction`) and who receives its files and emails; `apps` are the other SaaS accounts. An entry with `selected: false` is kept. From `getEmployeeSaasIdentities` of the leaver: `saasId` is the `companySaasApplicationId`, `identityId` the `saasApplicationUserId`. Only the fields you send change. Refused with `INTENT_NOT_FOUND`, `INTENT_ALREADY_EXECUTED` once executed, `TICKET_CLOSED` when its task is completed or cancelled, `EXECUTION_IN_PROGRESS`, `ACCOUNT_NOT_HELD_BY_LEAVER`, `IDP_NOT_EMAIL_PROVIDER`, `APP_IS_EMAIL_PROVIDER`, `DEPROVISIONING_STRATEGY_NOT_AVAILABLE`, `TRANSFER_TARGET_NOT_FOUND`. operationId: updateOffboardingAccessSelectionIntent parameters: - name: intentId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateOffboardingAccessSelectionIntentBody' responses: default: description: '' content: application/json: schema: $ref: '#/components/schemas/OffboardingAccessSelectionIntent_Output' components: schemas: UpdateOffboardingAccessSelectionIntentBody: type: object properties: idps: description: The email provider accounts (Google Workspace, Microsoft 365) anyOf: - type: array items: type: object properties: companySaasApplicationId: type: string pattern: ^[a-f\d]{24}$ saasApplicationUserId: description: The leaver account in that app type: string pattern: ^[a-f\d]{24}$ selected: description: Whether the account is removed; false keeps it default: true type: boolean accountAction: description: What happens to the mailbox account type: string enum: - SUSPEND - DELETE - DO_NOTHING fileTransferTarget: description: Who receives the leaver's files; null for nobody anyOf: - type: object properties: type: description: >- MANAGER: the leaver's manager at execution; USER: `employeeId` type: string enum: - MANAGER - USER employeeId: description: Required with USER anyOf: - type: string pattern: ^[a-f\d]{24}$ - type: 'null' required: - type - type: 'null' emailForwardingTarget: description: Who receives the leaver's emails; null for nobody anyOf: - type: object properties: type: description: >- MANAGER: the leaver's manager at execution; USER: `employeeId` type: string enum: - MANAGER - USER employeeId: description: Required with USER anyOf: - type: string pattern: ^[a-f\d]{24}$ - type: 'null' required: - type - type: 'null' required: - companySaasApplicationId - saasApplicationUserId - accountAction - type: 'null' apps: description: The other SaaS accounts anyOf: - type: array items: type: object properties: companySaasApplicationId: type: string pattern: ^[a-f\d]{24}$ saasApplicationUserId: description: The leaver account in that app type: string pattern: ^[a-f\d]{24}$ selected: description: Whether the account is removed; false keeps it default: true type: boolean keptByRuleReason: description: >- Why the published SaaS rule keeps the account, when it does anyOf: - type: string - type: 'null' required: - companySaasApplicationId - saasApplicationUserId - type: 'null' OffboardingAccessSelectionIntent_Output: type: object properties: id: type: string description: Intent id, to pass to its update and execute tools taskId: description: The typed task that tracks this step anyOf: - type: string - type: 'null' ticketId: description: >- The ticket holding that task, usually the offboarding ticket. Null if it could not be read back. anyOf: - type: string - type: 'null' offboardingId: type: string executedAt: description: When the intent executed; null until then anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' idps: type: array items: type: object properties: companySaasApplicationId: type: string saasApplicationUserId: type: string selected: type: boolean accountAction: type: string enum: - SUSPEND - DELETE - DO_NOTHING fileTransferTarget: anyOf: - type: object properties: type: type: string enum: - MANAGER - USER employeeId: anyOf: - type: string - type: 'null' required: - type - employeeId additionalProperties: false - type: 'null' emailForwardingTarget: anyOf: - type: object properties: type: type: string enum: - MANAGER - USER employeeId: anyOf: - type: string - type: 'null' required: - type - employeeId additionalProperties: false - type: 'null' required: - companySaasApplicationId - saasApplicationUserId - selected - accountAction - fileTransferTarget - emailForwardingTarget additionalProperties: false apps: type: array items: type: object properties: companySaasApplicationId: type: string saasApplicationUserId: type: string selected: type: boolean keptByRuleReason: anyOf: - type: string - type: 'null' required: - companySaasApplicationId - saasApplicationUserId - selected - keptByRuleReason additionalProperties: false required: - id - taskId - ticketId - offboardingId - executedAt - idps - apps additionalProperties: false securitySchemes: apikey: scheme: bearer bearerFormat: API key type: http description: >- Use your Primo API key in the Authorization header as `Bearer `. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.