Reset the password of an employee's identity on a SaaS application
Replace the password of the employee’s identity on this SaaS application and mail the new one to them. The password is never returned, so it cannot be repeated in a ticket, a comment or a reply — report only where it was sent.
The new password goes to the personal email address on the employee record, falling back to their professional one. Resetting the company’s email provider is the exception: it only ever delivers to the personal address, because the professional mailbox is the account being reset. Without a personal address on the record, that reset is refused.
There is no manual fallback. Unlike provisioning, an application with no connected API — or whose integration cannot set a password — is refused outright and no ticket is created. Only Google Workspace and Entra support this today.
The identity signs in with the new password once and is asked to choose another. Open sessions are left alone. Calling this again issues yet another password and invalidates the one already sent.
Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Path Parameters
Body
The Primo employee ID whose identity on this SaaS application gets a new password, as returned by the employee endpoints (id field). This is NOT a SaaS identity ID.
1Response
Which address the new password was sent to. The address itself is never returned — say "your personal email address" rather than spelling it out.
personal, professional delivered when the email left for the recipient. failed means the password WAS changed at the provider but the email did not go out: the identity is locked out and a human has to restore access.
delivered, failed Name of the SaaS application whose password was reset.