> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Get the SaaS identities of an employee
> Return every SaaS identity held by one employee, across all the SaaS applications of your company — use it to answer whether someone has access to a given application, and with which group, role, license and organization unit.
Each entry carries `saasId` (the company SaaS application, to pass to `getSaasById` or `provisionSaasIdentity`), `saasName`, the application `approvalStatus`, `identityId` (to pass to `deprovisionSaasIdentity`), and the assigned entitlements as `{ id, name }` pairs whose `id` is what `provisionSaasIdentity` expects.
Identities on applications that are not APPROVED are included — they are real accesses discovered by Primo, but they cannot be provisioned or deprovisioned until the application is approved.
To list the identities of one application rather than of one employee, use `getSaasById` instead.
Key: ReadScope: Company
## OpenAPI
````yaml https://api.getprimo.com/openapi.json get /employees/{employeeId}/saas-identities
openapi: 3.1.1
info:
title: Public API - BETA
description: Read docs on https://docs.getprimo.com/
version: '1.0'
contact: {}
servers:
- url: https://api.getprimo.com
security:
- apikey: []
tags: []
paths:
/employees/{employeeId}/saas-identities:
get:
tags:
- Saas
summary: Get the SaaS identities of an employee
description: >-
Return every SaaS identity held by one employee, across all the SaaS
applications of your company — use it to answer whether someone has
access to a given application, and with which group, role, license and
organization unit.
Each entry carries `saasId` (the company SaaS application, to pass to
`getSaasById` or `provisionSaasIdentity`), `saasName`, the application
`approvalStatus`, `identityId` (to pass to `deprovisionSaasIdentity`),
and the assigned entitlements as `{ id, name }` pairs whose `id` is what
`provisionSaasIdentity` expects.
Identities on applications that are not APPROVED are included — they are
real accesses discovered by Primo, but they cannot be provisioned or
deprovisioned until the application is approved.
To list the identities of one application rather than of one employee,
use `getSaasById` instead.
operationId: getEmployeeSaasIdentities
parameters:
- name: employeeId
required: true
in: path
schema:
type: string
responses:
default:
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/GetEmployeeSaasIdentities_Output'
components:
schemas:
GetEmployeeSaasIdentities_Output:
type: object
properties:
data:
type: array
items:
type: object
properties:
identityId:
description: >-
The SaaS identity ID. Pass this value as `identityId` to
deprovisionSaasIdentity. This is NOT an employee ID.
type: string
saasId:
description: >-
The company SaaS application ID (companySaasApplicationId)
this identity belongs to. Pass this value as `saasId` to the
other SaaS endpoints (getSaasById, provisionSaasIdentity, …).
This is NOT the global catalog saasApplicationId.
type: string
saasName:
description: Name of the SaaS application this identity belongs to.
anyOf:
- type: string
- type: 'null'
approvalStatus:
description: >-
Approval status of that SaaS application in your company. Only
an APPROVED application can be provisioned or deprovisioned —
an identity on a TO_REVIEW application is a real access the
employee has, discovered by Primo, on an application the
company has not approved yet.
anyOf:
- type: string
enum:
- TO_REVIEW
- APPROVED
- REJECTED
- type: 'null'
email:
description: Email of the account on the SaaS side.
type: string
type:
description: >-
Nature of the account on the SaaS side, when the provider
exposes it.
anyOf:
- type: string
enum:
- EMPLOYEE
- SERVICE
- GROUP
- GUEST
- CONTRACTOR
- type: 'null'
groups:
description: Groups assigned to this identity.
type: array
items:
type: object
properties:
id:
description: >-
Identifier of this entitlement in the SaaS application —
the same value `provisionSaasIdentity` expects in its
`groups`, `roles`, `licenses` and `organizationUnits`
arrays.
type: string
name:
description: Human-readable entitlement name.
type: string
required:
- id
- name
additionalProperties: false
roles:
description: Roles assigned to this identity.
type: array
items:
type: object
properties:
id:
description: >-
Identifier of this entitlement in the SaaS application —
the same value `provisionSaasIdentity` expects in its
`groups`, `roles`, `licenses` and `organizationUnits`
arrays.
type: string
name:
description: Human-readable entitlement name.
type: string
required:
- id
- name
additionalProperties: false
licenses:
description: Licenses assigned to this identity.
type: array
items:
type: object
properties:
id:
description: >-
Identifier of this entitlement in the SaaS application —
the same value `provisionSaasIdentity` expects in its
`groups`, `roles`, `licenses` and `organizationUnits`
arrays.
type: string
name:
description: Human-readable entitlement name.
type: string
required:
- id
- name
additionalProperties: false
organizationUnits:
description: Organization units assigned to this identity.
type: array
items:
type: object
properties:
id:
description: >-
Identifier of this entitlement in the SaaS application —
the same value `provisionSaasIdentity` expects in its
`groups`, `roles`, `licenses` and `organizationUnits`
arrays.
type: string
name:
description: Human-readable entitlement name.
type: string
required:
- id
- name
additionalProperties: false
issues:
description: >-
Provisioning issues currently flagged for this identity by the
configured SaaS rule.
type: array
items:
type: object
properties:
id:
type: string
type:
type: string
enum:
- NEED_ACCESS
- SHOULD_NOT_HAVE_ACCESS
- SHOULD_BE_MEMBER_OF_GROUP
- SHOULD_NOT_BE_MEMBER_OF_GROUP
- SHOULD_HAVE_ROLE
- SHOULD_NOT_HAVE_ROLE
- SHOULD_HAVE_LICENSE
- SHOULD_NOT_HAVE_LICENSE
- SHOULD_BE_IN_ORGANIZATION_UNIT
- ORPHANED_IDENTITY
groupId:
description: Group involved in the issue, when applicable.
anyOf:
- type: string
- type: 'null'
roleId:
description: Role involved in the issue, when applicable.
anyOf:
- type: string
- type: 'null'
licenseId:
description: License involved in the issue, when applicable.
anyOf:
- type: string
- type: 'null'
organizationUnitId:
description: >-
Organization unit involved in the issue, when
applicable.
anyOf:
- type: string
- type: 'null'
reason:
description: >-
Plain-language reason for this issue, displayed to the
end user.
anyOf:
- type: string
- type: 'null'
createdAt:
description: ISO 8601 date-time when the issue was created.
type: string
format: date-time
pattern: >-
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
required:
- id
- type
- groupId
- roleId
- licenseId
- organizationUnitId
- reason
- createdAt
additionalProperties: false
required:
- identityId
- saasId
- saasName
- approvalStatus
- email
- type
- groups
- roles
- licenses
- organizationUnits
- issues
additionalProperties: false
required:
- data
additionalProperties: false
securitySchemes:
apikey:
scheme: bearer
bearerFormat: API key
type: http
description: >-
Use your Primo API key in the Authorization header as `Bearer
`.
````