Create a SaaS identity directly, with no provisioning ticket

curl --request POST \
  --url https://api.getprimo.com/saas/{saasId}/identities \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "employeeId": "<string>",
  "email": "jsmith@example.com",
  "groups": [
    "<string>"
  ],
  "roles": [
    "<string>"
  ],
  "licenses": [
    "<string>"
  ],
  "organizationUnits": [
    "<string>"
  ]
}
'

import requests

url = "https://api.getprimo.com/saas/{saasId}/identities"

payload = {
    "employeeId": "<string>",
    "email": "jsmith@example.com",
    "groups": ["<string>"],
    "roles": ["<string>"],
    "licenses": ["<string>"],
    "organizationUnits": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    employeeId: '<string>',
    email: 'jsmith@example.com',
    groups: ['<string>'],
    roles: ['<string>'],
    licenses: ['<string>'],
    organizationUnits: ['<string>']
  })
};

fetch('https://api.getprimo.com/saas/{saasId}/identities', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.getprimo.com/saas/{saasId}/identities",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'employeeId' => '<string>',
    'email' => 'jsmith@example.com',
    'groups' => [
        '<string>'
    ],
    'roles' => [
        '<string>'
    ],
    'licenses' => [
        '<string>'
    ],
    'organizationUnits' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.getprimo.com/saas/{saasId}/identities"

	payload := strings.NewReader("{\n  \"employeeId\": \"<string>\",\n  \"email\": \"jsmith@example.com\",\n  \"groups\": [\n    \"<string>\"\n  ],\n  \"roles\": [\n    \"<string>\"\n  ],\n  \"licenses\": [\n    \"<string>\"\n  ],\n  \"organizationUnits\": [\n    \"<string>\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.getprimo.com/saas/{saasId}/identities")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"employeeId\": \"<string>\",\n  \"email\": \"jsmith@example.com\",\n  \"groups\": [\n    \"<string>\"\n  ],\n  \"roles\": [\n    \"<string>\"\n  ],\n  \"licenses\": [\n    \"<string>\"\n  ],\n  \"organizationUnits\": [\n    \"<string>\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.getprimo.com/saas/{saasId}/identities")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"employeeId\": \"<string>\",\n  \"email\": \"jsmith@example.com\",\n  \"groups\": [\n    \"<string>\"\n  ],\n  \"roles\": [\n    \"<string>\"\n  ],\n  \"licenses\": [\n    \"<string>\"\n  ],\n  \"organizationUnits\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>"
}

Saas

Create a SaaS identity directly, with no provisioning ticket

Create the identity record for an account on a SaaS application Primo cannot provision itself, writing it immediately — no provisioning ticket, no task for an admin. Use it when asked to create, add or register an identity, a user or an account on such an application.

It records an account rather than creating one on the application. When the account still has to be created over there, use provisionSaasIdentity.

Only for applications whose account creation is manual. One whose integration creates accounts itself is rejected with a 400, as is one that is not APPROVED.

Pass employeeId to attach the account to an employee, which offboarding needs to raise a removal task; pass email alone for an account no employee owns. Re-creating a recorded account updates it and keeps its employee.

Send entitlements as IDs from getSaasById: a name is resolved only on an application Primo does not already read that entitlement from, and is dropped silently elsewhere.

POST

saas

{saasId}

identities

Create a SaaS identity directly, with no provisioning ticket

curl --request POST \
  --url https://api.getprimo.com/saas/{saasId}/identities \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "employeeId": "<string>",
  "email": "jsmith@example.com",
  "groups": [
    "<string>"
  ],
  "roles": [
    "<string>"
  ],
  "licenses": [
    "<string>"
  ],
  "organizationUnits": [
    "<string>"
  ]
}
'

import requests

url = "https://api.getprimo.com/saas/{saasId}/identities"

payload = {
    "employeeId": "<string>",
    "email": "jsmith@example.com",
    "groups": ["<string>"],
    "roles": ["<string>"],
    "licenses": ["<string>"],
    "organizationUnits": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    employeeId: '<string>',
    email: 'jsmith@example.com',
    groups: ['<string>'],
    roles: ['<string>'],
    licenses: ['<string>'],
    organizationUnits: ['<string>']
  })
};

fetch('https://api.getprimo.com/saas/{saasId}/identities', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.getprimo.com/saas/{saasId}/identities",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'employeeId' => '<string>',
    'email' => 'jsmith@example.com',
    'groups' => [
        '<string>'
    ],
    'roles' => [
        '<string>'
    ],
    'licenses' => [
        '<string>'
    ],
    'organizationUnits' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.getprimo.com/saas/{saasId}/identities"

	payload := strings.NewReader("{\n  \"employeeId\": \"<string>\",\n  \"email\": \"jsmith@example.com\",\n  \"groups\": [\n    \"<string>\"\n  ],\n  \"roles\": [\n    \"<string>\"\n  ],\n  \"licenses\": [\n    \"<string>\"\n  ],\n  \"organizationUnits\": [\n    \"<string>\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.getprimo.com/saas/{saasId}/identities")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"employeeId\": \"<string>\",\n  \"email\": \"jsmith@example.com\",\n  \"groups\": [\n    \"<string>\"\n  ],\n  \"roles\": [\n    \"<string>\"\n  ],\n  \"licenses\": [\n    \"<string>\"\n  ],\n  \"organizationUnits\": [\n    \"<string>\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.getprimo.com/saas/{saasId}/identities")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"employeeId\": \"<string>\",\n  \"email\": \"jsmith@example.com\",\n  \"groups\": [\n    \"<string>\"\n  ],\n  \"roles\": [\n    \"<string>\"\n  ],\n  \"licenses\": [\n    \"<string>\"\n  ],\n  \"organizationUnits\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>"
}

Key: Write Scope: Company

Authorizations

Authorization

string

header

required

Use your Primo API key in the Authorization header as Bearer <API_KEY>.

Path Parameters

saasId

string

required

Body

application/json

employeeId

string

The Primo employee ID the identity belongs to, as returned by the employee endpoints (id field). When set, the identity is linked to that employee and its email is taken from the employee record. This is NOT a SaaS identity ID.

Minimum string length: 1

string<email>

Email of the account on the SaaS application. Required when employeeId is omitted; ignored when employeeId is set, since the employee email is used instead.

Pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$

groups

string[]

Groups the account belongs to, as IDs from getSaasById → groups[].id.

Minimum string length: 1

roles

string[]

Roles the account holds, as IDs from getSaasById → roles[].id.

Minimum string length: 1

licenses

string[]

Licenses the account holds, as IDs from getSaasById → licenses[].id.

Minimum string length: 1

organizationUnits

string[]

Organization units the account belongs to, as IDs from getSaasById → organizationUnits[].id.

Minimum string length: 1

Response

default - application/json

string

required

The created SaaS identity ID. Pass this value as saasApplicationUserId to archiveSaasApplicationUser or deleteSaasApplicationUser.

Getting Started

API Reference

Create a SaaS identity directly, with no provisioning ticket

Authorizations

Path Parameters

Body

Response