Skip to main content
POST
Ask for an account to be created on a SaaS application
Key: Write Scope: Company

Authorizations

Authorization
string
header
required

Use your Primo API key in the Authorization header as Bearer <API_KEY>.

Path Parameters

saasId
string
required

Body

application/json
employeeId
string
required

The Primo employee ID to provision on this SaaS application, as returned by the employee endpoints (id field). This is NOT a SaaS identity ID.

email
string<email>
required

The address the account is created with: one of the employee's addresses, emails from getEmployee. Refused when the employee does not have it.

Pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
groups
string[]

IDs of groups to assign. Retrieve available IDs from getSaasById → groups[].id.

Minimum string length: 1
roles
string[]

IDs of roles to assign. Retrieve available IDs from getSaasById → roles[].id.

Minimum string length: 1
licenses
string[]

IDs of licenses to assign. Retrieve available IDs from getSaasById → licenses[].id.

Minimum string length: 1
organizationUnits
string[]

Organization units the account belongs to, as IDs from getSaasById → organizationUnits[].id.

Minimum string length: 1
ticketId
string

The ticket the request came from. When the application has to be provisioned by hand, the task for the admin is added to this ticket instead of opening a new provisioning ticket.

Pattern: ^[a-f\d]{24}$
credentialsRecipient
object

Who receives the temporary password of an application that generates one (Microsoft Entra, Google Workspace): such an application is refused with CREDENTIALS_RECIPIENT_REQUIRED without it. An application that sets no password does not need it.

Response

default - application/json
provisioningType
enum<string>
required

Whether the provisioning was handled automatically via API or a manual ticket was created.

Available options:
automatic,
manual