> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ask for an account to be created on a SaaS application

> Get an employee an account on a SaaS application, with optional group, role, license and organization unit assignments. The account does not exist yet: this endpoint is what brings it into being.

When the application already has the account and you only need Primo to know about it, use `createSaasIdentity` instead — this endpoint would open a provisioning ticket asking an admin to create an account that is already there.

Works on any APPROVED application. With an API integration the account is created **automatically**; without one a **provisioning ticket** is raised for an admin to create it by hand, which takes as long as the admin takes. The `provisioningType` field in the response says which path was taken.

<span className="badge-write">Key: Write</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json post /saas/{saasId}/provision
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /saas/{saasId}/provision:
    post:
      tags:
        - Saas
      summary: Ask for an account to be created on a SaaS application
      description: >-
        Get an employee an account on a SaaS application, with optional group,
        role, license and organization unit assignments. The account does not
        exist yet: this endpoint is what brings it into being.


        When the application already has the account and you only need Primo to
        know about it, use `createSaasIdentity` instead — this endpoint would
        open a provisioning ticket asking an admin to create an account that is
        already there.


        Works on any APPROVED application. With an API integration the account
        is created **automatically**; without one a **provisioning ticket** is
        raised for an admin to create it by hand, which takes as long as the
        admin takes. The `provisioningType` field in the response says which
        path was taken.
      operationId: provisionSaasIdentity
      parameters:
        - name: saasId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisionSaasIdentityBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvisionSaasIdentity_Output'
components:
  schemas:
    ProvisionSaasIdentityBody:
      type: object
      properties:
        employeeId:
          description: >-
            The Primo employee ID to provision on this SaaS application, as
            returned by the employee endpoints (`id` field). This is NOT a SaaS
            identity ID.
          type: string
        groups:
          description: >-
            IDs of groups to assign. Retrieve available IDs from `getSaasById` →
            `groups[].id`.
          type: array
          items:
            type: string
            minLength: 1
        roles:
          description: >-
            IDs of roles to assign. Retrieve available IDs from `getSaasById` →
            `roles[].id`.
          type: array
          items:
            type: string
            minLength: 1
        licenses:
          description: >-
            IDs of licenses to assign. Retrieve available IDs from `getSaasById`
            → `licenses[].id`.
          type: array
          items:
            type: string
            minLength: 1
        organizationUnits:
          description: >-
            Organization units the account belongs to, as IDs from `getSaasById`
            → `organizationUnits[].id`.
          type: array
          items:
            type: string
            minLength: 1
      required:
        - employeeId
    ProvisionSaasIdentity_Output:
      type: object
      properties:
        provisioningType:
          type: string
          description: >-
            Whether the provisioning was handled automatically via API or a
            manual ticket was created.
          enum:
            - automatic
            - manual
      required:
        - provisioningType
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````