> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Provision a SaaS identity

> Provision an employee on a SaaS application with optional group, role, license, and organization unit assignments.

Depending on the SaaS application capabilities, the provisioning is either handled **automatically** (via API integration) or **manually** (a provisioning ticket is created for an admin to complete).

The response indicates which path was taken via the `provisioningType` field.

<span className="badge-write">Key: Write</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json post /saas/{saasId}/provision
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /saas/{saasId}/provision:
    post:
      tags:
        - Saas
      summary: Provision a SaaS identity
      description: >-
        Provision an employee on a SaaS application with optional group, role,
        license, and organization unit assignments.


        Depending on the SaaS application capabilities, the provisioning is
        either handled **automatically** (via API integration) or **manually**
        (a provisioning ticket is created for an admin to complete).


        The response indicates which path was taken via the `provisioningType`
        field.
      operationId: provisionSaasIdentity
      parameters:
        - name: saasId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisionSaasIdentityBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvisionSaasIdentity_Output'
components:
  schemas:
    ProvisionSaasIdentityBody:
      type: object
      properties:
        employeeId:
          description: >-
            The Primo employee ID to provision on this SaaS application, as
            returned by the employee endpoints (`id` field). This is NOT a SaaS
            identity ID.
          type: string
        groups:
          description: >-
            IDs of groups to assign. Retrieve available IDs from `getSaasById` →
            `groups[].id`.
          type: array
          items:
            type: string
            minLength: 1
        roles:
          description: >-
            IDs of roles to assign. Retrieve available IDs from `getSaasById` →
            `roles[].id`.
          type: array
          items:
            type: string
            minLength: 1
        licenses:
          description: >-
            IDs of licenses to assign. Retrieve available IDs from `getSaasById`
            → `licenses[].id`.
          type: array
          items:
            type: string
            minLength: 1
        organizationUnits:
          description: >-
            IDs of organization units to assign. Retrieve available IDs from
            `getSaasById` → `organizationUnits[].id`.
          type: array
          items:
            type: string
            minLength: 1
      required:
        - employeeId
    ProvisionSaasIdentity_Output:
      type: object
      properties:
        provisioningType:
          type: string
          description: >-
            Whether the provisioning was handled automatically via API or a
            manual ticket was created.
          enum:
            - automatic
            - manual
      required:
        - provisioningType
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````