Ask for an account to be created on a SaaS application
Get an employee an account on a SaaS application, with optional group, role, license and organization unit assignments. The account does not exist yet: this endpoint is what brings it into being.
When the application already has the account and you only need Primo to know about it, use createSaasIdentity instead — this endpoint would open a provisioning ticket asking an admin to create an account that is already there.
The account is created with email, one of the employee’s addresses (emails from getEmployee).
Works on any APPROVED application. With an API integration the account is created automatically; without one a provisioning task is raised for an admin to create it by hand, which takes as long as the admin takes — on the ticket given as ticketId, or on a new provisioning ticket when none is given. The provisioningType field in the response says which path was taken.
An application that generates a password (Microsoft Entra, Google Workspace) needs credentialsRecipient, who receives it, or is refused with CREDENTIALS_RECIPIENT_REQUIRED: pass EMPLOYEE with the employee’s personal address to send it straight to them. A professional mailbox an onboarding tracks is createEmailAccountIntent instead.
Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Path Parameters
Body
The Primo employee ID to provision on this SaaS application, as returned by the employee endpoints (id field). This is NOT a SaaS identity ID.
The address the account is created with: one of the employee's addresses, emails from getEmployee. Refused when the employee does not have it.
^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$IDs of groups to assign. Retrieve available IDs from getSaasById → groups[].id.
1IDs of roles to assign. Retrieve available IDs from getSaasById → roles[].id.
1IDs of licenses to assign. Retrieve available IDs from getSaasById → licenses[].id.
1Organization units the account belongs to, as IDs from getSaasById → organizationUnits[].id.
1The ticket the request came from. When the application has to be provisioned by hand, the task for the admin is added to this ticket instead of opening a new provisioning ticket.
^[a-f\d]{24}$Who receives the temporary password of an application that generates one (Microsoft Entra, Google Workspace): such an application is refused with CREDENTIALS_RECIPIENT_REQUIRED without it. An application that sets no password does not need it.
Response
Whether the provisioning was handled automatically via API or a manual ticket was created.
automatic, manual