Take a licence off a SaaS identity
Take one of the application’s licences off the account. The account itself is left in place, and keeps whatever else it holds — to remove the account entirely, use deprovisionSaasIdentity.
It changes what an existing account holds — it never creates one. When the employee has no account on the application yet, use provisionSaasIdentity, which takes the entitlements in the same call.
Do not confuse it with addSaasGroup / addSaasRole / addSaasLicence / addSaasOrganizationUnit: those add an entry to the application’s catalogue, for everyone, and only on a manually-provisioned application. This one assigns an existing catalogue entry to one person.
With an API integration the change is applied automatically; without one a provisioning ticket is raised for an admin to carry it out, which takes as long as the admin takes — the response says which path was taken in provisioningType. A call that asks for what is already true changes nothing and returns changed: false.
Authorizations
Use your Primo API key in the Authorization header as Bearer <API_KEY>.
Response
False when the identity already stood as asked — the entitlement was already assigned, or already absent. Nothing was sent to the application in that case.
How the change is being applied: automatic when the integration carries it out, manual when a provisioning ticket was raised for an admin. null when nothing changed.
automatic, manual