Get a SaaS by ID
Return the SaaS details for the given company SaaS application ID — owner, identities, recent events, contract and provisioning rule.
An application that is not APPROVED is returned too: read approvalStatus before concluding anything from it. It cannot be provisioned, whatever the rest of the payload says. Its contract and rule are usually null, but an application that was approved once and later rejected keeps the contract and rule it had then — treat them as history, not as an active configuration.
To find the identities no employee owns across every application, use getUnlinkedSaasIdentities instead of reading each application here.
Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Path Parameters
Response
The company SaaS application ID (companySaasApplicationId). Pass this value as saasId to the other SaaS endpoints (getSaasById, getSaasIssues, provision/deprovision, …).
Approval status of the SaaS application in your company. APPROVED is what makes provisioning possible — including manual provisioning, for an application Primo has no integration with. TO_REVIEW and REJECTED applications cannot be provisioned at all.
TO_REVIEW, APPROVED, REJECTED State of the API integration between Primo and this application. NOT_CONNECTABLE: Primo has no connector for it. NOT_CONNECTED: a connector exists but your company has not set it up. CONNECTED / DISCONNECTED: your company's connection is live or has lost its credentials. This does NOT say whether the employee can be provisioned: an APPROVED application is provisioned through provisionSaasIdentity whatever this value is — the integration only decides the path, automatic when CONNECTED and a provisioning ticket for an admin otherwise.
CONNECTED, DISCONNECTED, PENDING, NOT_CONNECTED, NOT_CONNECTABLE 0 <= x <= 9007199254740991True on an application the company's mailboxes live in — one of its email providers. A company can have several, even of different vendors (two Google Workspace instances and an Entra): the one behind an email password reset is the instance holding the account of the locked-out address (getEmployeeSaasIdentities). Everything else is an ordinary SaaS application, whatever its name suggests.
The employee who owns the application in your company (set with updateSaasOwner), or null when nobody does: the person to ask about an account Primo cannot create.
The 20 most synchronization-related recent events for this SaaS integration.
Billing contract currently configured for this SaaS.
Derived financial metrics computed from the configured contract.
SaaS license catalog — all available licenses for this SaaS application.
All groups available in this SaaS application. Use id when provisioning.
All roles available in this SaaS application. Use id when provisioning.
All organization units available in this SaaS application. Use id when provisioning.
Provisioning rule configured for this SaaS, or null if no rule has been authored yet.