1Password SaaS Manager

Deletes the device with the given SaaS Manager ID. **Required scope:** `Assets.Write` (Write access to devices)

Deletes a contract by its SaaS Manager ID or by your own external ID. **Required scope:** `Contracts.Write` (Write access to contracts)

Deletes the team with the given ID, along with its descendants, and removes the corresponding memberships from people. Teams that are in use by integrations cannot be deleted. **Required scope:** `People.Write` (Write access to people and teams)

Removes a user's SaaS Manager access, following the SCIM 2.0 protocol (RFC 7644). Returns 204 No Content on success. System-managed and EPM-managed users cannot be deleted (400). **Required scope:** `Users.Write` (Write access to users with access to SaaS Manager)

Returns a paginated list of the applications in your organization. Use `filter` and `q` to narrow the results, and follow the `next` link (also provided in the `link` response header) to page through large result sets. **Required scope:** `Apps.Read` (Read-only access to applications)

Fetches a single application (a managed SaaS app in your organization) by its ID. **Required scope:** `Apps.Read` (Read-only access to applications)

Returns a paginated list of the accounts (users) on a given application. Follow the `next` link to page through large result sets. **Required scope:** `Apps.Users.Read` (Read-only access to application accounts)

Returns the application category tags as a nested hierarchy. **Required scope:** `Apps.Read` (Read-only access to applications)

Returns the application custom fields defined for your organization. Use the field `lookupKey` values as the keys of the `customFields` object when creating or updating an application. **Required scope:** `Apps.Read` (Read-only access to applications)

Returns a paginated list of the devices in your organization. Use `filter` and `q` to narrow the results, and follow the `next` link (also provided in the `link` response header) to page through large result sets. **Required scope:** `Assets.Read` (Read-only access to devices)

Returns the device custom fields defined for your organization. Use the field `lookupKey` values as the keys of the `customFields` object when creating or updating a device. **Required scope:** `Assets.Read` (Read-only access to devices)

Fetches a single device by its SaaS Manager ID. **Required scope:** `Assets.Read` (Read-only access to devices)

Returns audit log events for your organization, oldest first. The audit log is a continuous, append-only stream. Pagination is cursor-based but differs from the rest of the SaaS Manager API: the response's `next` field (and the `link` response header, `rel="next"`) always returns a cursor URL — even on the last page — so you can keep following it to receive new events as they are written. Page until no further `results` are returned, then poll the same `next` URL periodically to pick up new events. Narrow results with `since`/`until` (a time window — by default the last 7 days), a SCIM-style `filter` (all operators except `[ ]`), or a free-text `q` query (matches the actor/target name, target email, and exactly matches event ID, event type, target ID and target type). Use `sortOrder=DESCENDING` to return newest events first. `limit` defaults to 100 (maximum 1000).

Returns a paginated list of the contracts in your organization. Use `filter` and `q` to narrow the results, and follow the `next` link (also provided in the `link` response header) to page through large result sets. **Required scope:** `Contracts.Read` (Read-only access to contracts)

Fetches a single contract by its SaaS Manager ID or by your own external ID. **Required scope:** `Contracts.Read` (Read-only access to contracts)

Returns a paginated list of the people in your organization. Use `filter` and `q` to narrow the results, and follow the `next` link (also provided in the `link` response header) to page through large result sets. **Required scope:** `People.Read` (Read-only access to people and teams)

Fetches a single person by their SaaS Manager ID (a UUID) or by email address. If an email address matches more than one person a 409 Conflict is returned. **Required scope:** `People.Read` (Read-only access to people and teams)

Returns a paginated list of the applications a person has an account on, identified by their SaaS Manager ID or email address. If an email address matches more than one person a 409 Conflict is returned. **Required scope:** `People.Read` (Read-only access to people and teams)

Fetches a single team by ID, including its parent team ID (if any). **Required scope:** `People.Read` (Read-only access to people and teams)

Returns all teams as a flat list; each entry carries its parent team ID (if any). **Required scope:** `People.Read` (Read-only access to people and teams)

Returns all teams as a nested tree, starting from the root teams. **Required scope:** `People.Read` (Read-only access to people and teams)

Returns the SCIM 2.0 resource types this provider exposes (RFC 7643), in a SCIM `ListResponse` envelope. SCIM clients read this during discovery. Per the SCIM standard, supplying a `filter` is not permitted.

Returns the SCIM 2.0 "User" resource type definition (RFC 7643).

Lists users with SaaS Manager access, following the SCIM 2.0 protocol (RFC 7644). Results are returned in a SCIM `ListResponse` envelope (`totalResults`, `itemsPerPage`, `startIndex`, `Resources`). Paging is SCIM-style — 1-based `startIndex` plus `count` (default and maximum 100) — not the cursor paging used elsewhere in the SaaS Manager API. An optional SCIM `filter` expression (e.g. `userName eq "john.doe@example.com"`) narrows the results.

Fetches a single user by SCIM resource ID, following the SCIM 2.0 protocol (RFC 7644).

Returns a paginated list of the published workflows in your organization, including each workflow's trigger and steps. Use `filter` and `q` to narrow the results, and follow the `next` link (also provided in the `link` response header) to page through large result sets. **Required scope:** `Workflows.Read` (Read-only access to workflow definitions)

Returns the published workflow with the given ID, including its trigger and steps. The workflow is returned inside a one-item result page (empty if no workflow has that ID). **Required scope:** `Workflows.Read` (Read-only access to workflow definitions)

Returns a paginated list of the runs (individual executions) of a workflow, including the run's context, current step states and any waiting actions. Use `filter` and `q` to narrow the results, and follow the `next` link to page through large result sets. **Variables:** workflow variable values are not returned by default. Pass the `variables` query parameter — a comma-separated list of variable IDs — to include those variables' values in each run's context. Reading the value of a **secret** (password) variable additionally requires the `Workflows.Runs.ReadSecrets` scope; requesting a secret variable without it returns `401`. **Required scope:** `Workflows.Runs.Read` (Read-only access to workflow runs)

Returns the run with the given ID for the workflow, including its context and step states, inside a one-item result page (empty if no run has that ID). The `variables` query parameter and the `Workflows.Runs.ReadSecrets` scope behave as for listing runs. **Required scope:** `Workflows.Runs.Read` (Read-only access to workflow runs)

Redirects the user to the SaaS Manager consent screen. After the user consents, the browser is redirected back to `redirect_uri` with a `code` (and `state`) query parameter, which you then exchange for a token at `/connect/token`. This is a browser-redirect endpoint, not a JSON API call.

Partially updates an application: only the fields present in the request body are changed. Omitting a field leaves it untouched, whereas sending an explicit `null` clears it. At least one field must be supplied. **Required scope:** `Apps.Write` (Write access to applications)

Partially updates a device: only the fields present in the request body are changed. Omitting a field leaves it untouched, whereas sending an explicit `null` clears it. At least one field must be supplied. **Required scope:** `Assets.Write` (Write access to devices)

Partially updates a person: only the fields present in the request body are changed. Omitting a field leaves it untouched, whereas sending an explicit `null` clears it. At least one field must be supplied. **Required scope:** `People.Write` (Write access to people and teams)

Applies a SCIM PATCH operation set to a user, following the SCIM 2.0 protocol (RFC 7644). The request body must use the SCIM PatchOp schema (`urn:ietf:params:scim:api:messages:2.0:PatchOp`) and supply one or more `add`/`replace`/ `remove` operations, each with a `path`. `userName` is immutable. EPM-managed and system-managed users cannot be modified (403). **Required scope:** `Users.Write` (Write access to users with access to SaaS Manager)

Adds a managed application to your organization. Identify the underlying app with either `globalAppId` or `globalAppName` (exactly one is required). When supplying a name that does not match an app in the global catalog, supply `vendorName` and a new local vendor is created. Returns 409 if the application already exists. **Required scope:** `Apps.Write` (Write access to applications)

Creates a user, following the SCIM 2.0 protocol (RFC 7644). `userName` is required and must belong to a domain verified for your organization; it must not already be in use (a duplicate returns 409). Server-controlled fields (`id`, `meta`) are ignored on the request and set by the service. Returns 201 with the created user and a `Location` header. **Required scope:** `Users.Write` (Write access to users with access to SaaS Manager)

Fires a named signal (for example an approval or rejection) on a workflow step that is currently waiting for input, allowing the run to continue. The valid signals for a waiting step — and the URL to call to fire each one — are listed under the step's `waiting.actions` in the run's response, so a client can simply `POST` to the supplied `href`. Returns `200` when the signal was fired and the run advanced. Returns `409` if the step is no longer waiting (for example it has already been signalled or has timed out), and `404` if the run or workflow cannot be found. **Required scope:** `Workflows.Runs.Execute` (Execute workflow run actions)

Exchanges client credentials (or an authorization code / refresh token) for an access token. The client ID and secret are sent via HTTP Basic authentication. The body is `application/x-www-form-urlencoded`. - **Client Credentials:** `grant_type=client_credentials` (optional `scope`). - **Authorization Code:** `grant_type=authorization_code` with `code` and `redirect_uri`. - **Refresh:** `grant_type=refresh_token` with `refresh_token` (requires the `offline_access` scope).

Creates a new device, or fully replaces an existing one when an ID is supplied (in the route or in the body). When creating, `hardwareVendor` and `modelName` are required. Assign the device to a person with `assignedToEmail` and to a location with `locationName` (a location is created if needed). `netPrice` is converted to your base currency. **Required scope:** `Assets.Write` (Write access to devices)

Creates a contract, or updates an existing one matched by its `id` or your own `externalId`. Either all line items carry an `externalId` or none do. Set the business owner with `businessOwnerEmail`. **Required scope:** `Contracts.Write` (Write access to contracts)

Creates a new person, or fully replaces an existing one when an ID is supplied (in the route or in the body). When creating, the email address must not already be in use. Set the line manager with lineManagerId or lineManagerEmail. Team membership is replaced wholesale: supply either teams (by ID or name) or teamIds (not both) — omitting both removes the person's manually-assigned teams. **Required scope:** `People.Write` (Write access to people and teams)

Creates a new team when no ID is supplied (returns 201 with the created team), or updates an existing team's name and/or parent when an ID is supplied (returns 200). A team cannot be moved beneath one of its own descendants. **Required scope:** `People.Write` (Write access to people and teams)

Replaces a user's attributes, following the SCIM 2.0 protocol (RFC 7644). Server-controlled fields (`id`, `meta`) are ignored on the request. EPM-managed and system-managed users, and users shared across multiple organizations, cannot be modified (403). **Required scope:** `Users.Write` (Write access to users with access to SaaS Manager)