Reset the password of an employee's identity on a SaaS application
Replace the password of the employee’s identity on this SaaS application and mail the new one to them. The password is never returned, so it cannot be repeated in a ticket, a comment or a reply — report only where it was sent.
The new password goes to the employee’s contact address: their personal email address before their start date, their main professional one from then on. Resetting an instance of the company’s email provider never delivers to a mailbox that instance hosts: the address is chosen among the employee’s addresses on other domains, and the reset is refused when they have none.
There is no manual fallback. Unlike provisioning, an application with no connected API — or whose integration cannot set a password — is refused outright and no ticket is created. Only Google Workspace and Entra support this today.
The identity signs in with the new password once and is asked to choose another. Open sessions are left alone. Calling this again issues yet another password and invalidates the one already sent.
Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Path Parameters
Body
The Primo employee ID whose identity on this SaaS application gets a new password, as returned by the employee endpoints (id field). This is NOT a SaaS identity ID.
1Response
Which address the new password was sent to: personal for an address outside the company domains, professional for a work address (on an email provider, one the reset instance does not host). The address itself is never returned — say "your personal email address" or "your other work email address" rather than spelling it out.
personal, professional delivered when the email left for the recipient. failed means the password WAS changed at the provider but the email did not go out: the identity is locked out and a human has to restore access.
delivered, failed Name of the SaaS application whose password was reset.