> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Reset the password of an employee's identity on a SaaS application

> Replace the password of the employee's identity on this SaaS application and mail the new one to them. The password is never returned, so it cannot be repeated in a ticket, a comment or a reply — report only where it was sent.

The new password goes to the **personal** email address on the employee record, falling back to their professional one. Resetting the company's **email provider** is the exception: it only ever delivers to the personal address, because the professional mailbox is the account being reset. Without a personal address on the record, that reset is refused.

**There is no manual fallback.** Unlike provisioning, an application with no connected API — or whose integration cannot set a password — is refused outright and no ticket is created. Only Google Workspace and Entra support this today.

The identity signs in with the new password once and is asked to choose another. Open sessions are left alone. Calling this again issues yet another password and invalidates the one already sent.

<span className="badge-write">Key: Write</span><span className="badge-company">Scope: Company</span>


## OpenAPI

````yaml https://api.getprimo.com/openapi.json post /saas/{saasId}/reset-password
openapi: 3.1.1
info:
  title: Public API - BETA
  description: Read docs on https://docs.getprimo.com/
  version: '1.0'
  contact: {}
servers:
  - url: https://api.getprimo.com
security:
  - apikey: []
tags: []
paths:
  /saas/{saasId}/reset-password:
    post:
      tags:
        - Saas
      summary: Reset the password of an employee's identity on a SaaS application
      description: >-
        Replace the password of the employee's identity on this SaaS application
        and mail the new one to them. The password is never returned, so it
        cannot be repeated in a ticket, a comment or a reply — report only where
        it was sent.


        The new password goes to the **personal** email address on the employee
        record, falling back to their professional one. Resetting the company's
        **email provider** is the exception: it only ever delivers to the
        personal address, because the professional mailbox is the account being
        reset. Without a personal address on the record, that reset is refused.


        **There is no manual fallback.** Unlike provisioning, an application
        with no connected API — or whose integration cannot set a password — is
        refused outright and no ticket is created. Only Google Workspace and
        Entra support this today.


        The identity signs in with the new password once and is asked to choose
        another. Open sessions are left alone. Calling this again issues yet
        another password and invalidates the one already sent.
      operationId: resetSaasIdentityPassword
      parameters:
        - name: saasId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResetSaasIdentityPasswordBody'
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResetSaasIdentityPassword_Output'
components:
  schemas:
    ResetSaasIdentityPasswordBody:
      type: object
      properties:
        employeeId:
          description: >-
            The Primo employee ID whose identity on this SaaS application gets a
            new password, as returned by the employee endpoints (`id` field).
            This is NOT a SaaS identity ID.
          type: string
          minLength: 1
      required:
        - employeeId
    ResetSaasIdentityPassword_Output:
      type: object
      properties:
        recipientType:
          type: string
          description: >-
            Which address the new password was sent to. The address itself is
            never returned — say "your personal email address" rather than
            spelling it out.
          enum:
            - personal
            - professional
        deliveryStatus:
          type: string
          description: >-
            `delivered` when the email left for the recipient. `failed` means
            the password WAS changed at the provider but the email did not go
            out: the identity is locked out and a human has to restore access.
          enum:
            - delivered
            - failed
        saasApplicationName:
          type: string
          description: Name of the SaaS application whose password was reset.
      required:
        - recipientType
        - deliveryStatus
        - saasApplicationName
      additionalProperties: false
  securitySchemes:
    apikey:
      scheme: bearer
      bearerFormat: API key
      type: http
      description: >-
        Use your Primo API key in the Authorization header as `Bearer
        <API_KEY>`.

````