> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create several SaaS identities directly, with no provisioning ticket

> Record MULTIPLE accounts on a SaaS application Primo cannot provision itself — the batch form of `createSaasIdentity`, with the same rules per item. Use it to onboard a list of employees onto a manually-managed application in one call.

Same constraints as the single form: only an APPROVED application whose account creation is manual, `employeeId` to attach the account to an employee or `email` alone for an account no employee owns, and re-creating a recorded account updates it and keeps its employee.

Writes are independent and best-effort: the call returns 200 with a `results` manifest reporting `ok` / `error` per item — always inspect `results` rather than relying on the HTTP status to detect partial failures.

<span className="badge-write">Key: Write</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json post /saas/{saasId}/identities/batch
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /saas/{saasId}/identities/batch:
    post:
      tags:
        - Saas
      summary: Create several SaaS identities directly, with no provisioning ticket
      description: >-
        Record MULTIPLE accounts on a SaaS application Primo cannot provision
        itself — the batch form of `createSaasIdentity`, with the same rules per
        item. Use it to onboard a list of employees onto a manually-managed
        application in one call.


        Same constraints as the single form: only an APPROVED application whose
        account creation is manual, `employeeId` to attach the account to an
        employee or `email` alone for an account no employee owns, and
        re-creating a recorded account updates it and keeps its employee.


        Writes are independent and best-effort: the call returns 200 with a
        `results` manifest reporting `ok` / `error` per item — always inspect
        `results` rather than relying on the HTTP status to detect partial
        failures.
      operationId: createSaasIdentities
      parameters:
        - name: saasId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSaasIdentitiesBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSaasIdentitiesResult_Output'
components:
  schemas:
    CreateSaasIdentitiesBody:
      type: object
      properties:
        items:
          description: >-
            The identities to record, each carrying the same fields as
            `createSaasIdentity`. Up to 100 items per call, each employee or
            email at most once. Writes are best-effort: inspect the per-item
            `results` to learn which succeeded.
          minItems: 1
          maxItems: 100
          type: array
          items:
            type: object
            properties:
              employeeId:
                description: >-
                  The Primo employee ID the identity belongs to, as returned by
                  the employee endpoints (`id` field). When set, the identity is
                  linked to that employee and its email is taken from the
                  employee record. This is NOT a SaaS identity ID.
                type: string
                minLength: 1
              email:
                description: >-
                  Email of the account on the SaaS application. Required when
                  `employeeId` is omitted; ignored when `employeeId` is set,
                  since the employee email is used instead.
                type: string
                format: email
                pattern: >-
                  ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
              groups:
                description: >-
                  Groups the account belongs to, as IDs from `getSaasById` →
                  `groups[].id`.
                type: array
                items:
                  type: string
                  minLength: 1
              roles:
                description: >-
                  Roles the account holds, as IDs from `getSaasById` →
                  `roles[].id`.
                type: array
                items:
                  type: string
                  minLength: 1
              licenses:
                description: >-
                  Licenses the account holds, as IDs from `getSaasById` →
                  `licenses[].id`.
                type: array
                items:
                  type: string
                  minLength: 1
              organizationUnits:
                description: >-
                  Organization units the account belongs to, as IDs from
                  `getSaasById` → `organizationUnits[].id`.
                type: array
                items:
                  type: string
                  minLength: 1
      required:
        - items
    CreateSaasIdentitiesResult_Output:
      type: object
      properties:
        successCount:
          type: integer
          description: Number of identities created successfully.
          minimum: -9007199254740991
          maximum: 9007199254740991
        failureCount:
          type: integer
          description: Number of identities that failed.
          minimum: -9007199254740991
          maximum: 9007199254740991
        results:
          type: array
          description: Per-item outcome, in the same order as the input `items`.
          items:
            type: object
            properties:
              status:
                type: string
                enum:
                  - ok
                  - error
              errorCode:
                description: Machine-readable error code when status is "error".
                anyOf:
                  - type: string
                  - type: 'null'
              message:
                description: Human-readable error detail when status is "error".
                anyOf:
                  - type: string
                  - type: 'null'
              employeeId:
                description: The employee the item targeted, echoed from the input.
                anyOf:
                  - type: string
                  - type: 'null'
              email:
                description: The email the item targeted, echoed from the input.
                anyOf:
                  - type: string
                  - type: 'null'
              id:
                description: The created SaaS identity ID when status is "ok".
                anyOf:
                  - type: string
                  - type: 'null'
            required:
              - status
            additionalProperties: false
      required:
        - successCount
        - failureCount
        - results
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````