> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a SaaS identity directly, with no provisioning ticket

> Create the identity record for an account on a SaaS application Primo cannot provision itself, writing it immediately — no provisioning ticket, no task for an admin. Use it when asked to create, add or register an identity, a user or an account on such an application.

It records an account rather than creating one on the application. When the account still has to be created over there, use `provisionSaasIdentity`.

Only for applications whose account creation is manual. One whose integration creates accounts itself is rejected with a 400, as is one that is not APPROVED.

Pass `employeeId` to attach the account to an employee, which offboarding needs to raise a removal task; pass `email` alone for an account no employee owns. Re-creating a recorded account updates it and keeps its employee.

Send entitlements as IDs from `getSaasById`: a name is resolved only on an application Primo does not already read that entitlement from, and is dropped silently elsewhere.

<span className="badge-write">Key: Write</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json post /saas/{saasId}/identities
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /saas/{saasId}/identities:
    post:
      tags:
        - Saas
      summary: Create a SaaS identity directly, with no provisioning ticket
      description: >-
        Create the identity record for an account on a SaaS application Primo
        cannot provision itself, writing it immediately — no provisioning
        ticket, no task for an admin. Use it when asked to create, add or
        register an identity, a user or an account on such an application.


        It records an account rather than creating one on the application. When
        the account still has to be created over there, use
        `provisionSaasIdentity`.


        Only for applications whose account creation is manual. One whose
        integration creates accounts itself is rejected with a 400, as is one
        that is not APPROVED.


        Pass `employeeId` to attach the account to an employee, which
        offboarding needs to raise a removal task; pass `email` alone for an
        account no employee owns. Re-creating a recorded account updates it and
        keeps its employee.


        Send entitlements as IDs from `getSaasById`: a name is resolved only on
        an application Primo does not already read that entitlement from, and is
        dropped silently elsewhere.
      operationId: createSaasIdentity
      parameters:
        - name: saasId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSaasIdentityBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSaasIdentity_Output'
components:
  schemas:
    CreateSaasIdentityBody:
      type: object
      properties:
        employeeId:
          description: >-
            The Primo employee ID the identity belongs to, as returned by the
            employee endpoints (`id` field). When set, the identity is linked to
            that employee and its email is taken from the employee record. This
            is NOT a SaaS identity ID.
          type: string
          minLength: 1
        email:
          description: >-
            Email of the account on the SaaS application. Required when
            `employeeId` is omitted; ignored when `employeeId` is set, since the
            employee email is used instead.
          type: string
          format: email
          pattern: >-
            ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
        groups:
          description: >-
            Groups the account belongs to, as IDs from `getSaasById` →
            `groups[].id`.
          type: array
          items:
            type: string
            minLength: 1
        roles:
          description: Roles the account holds, as IDs from `getSaasById` → `roles[].id`.
          type: array
          items:
            type: string
            minLength: 1
        licenses:
          description: >-
            Licenses the account holds, as IDs from `getSaasById` →
            `licenses[].id`.
          type: array
          items:
            type: string
            minLength: 1
        organizationUnits:
          description: >-
            Organization units the account belongs to, as IDs from `getSaasById`
            → `organizationUnits[].id`.
          type: array
          items:
            type: string
            minLength: 1
    CreateSaasIdentity_Output:
      type: object
      properties:
        id:
          type: string
          description: >-
            The created SaaS identity ID. Pass this value as
            `saasApplicationUserId` to `archiveSaasApplicationUser` or
            `deleteSaasApplicationUser`.
      required:
        - id
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````