Skip to content

Automation  ·  IT and security

How to build SaaS licence reclamation

Renewal arrives for four hundred seats and about half of them belong to people who have not signed in since March. This is the design behind reclaiming them, the prompts that build it, and what production adds.

Built with Tray Headless

  1. System Vendor admin API
  2. Step Last active per seat
  3. Step Ask the holder
  4. Step Reclaim on schedule
  5. System Okta
Also NetSuite

Nobody loses a seat without being asked first, and reclamation runs before the renewal rather than after the invoice.

The short answer

What is SaaS licence reclamation?

There are four parts to licence reclamation: last-active data pulled per seat instead of per account, a grace period where the holder is asked before anything is taken, reclamation timed to run before renewal instead of after the invoice, and the saving reported where finance can act on it. The common failure is reclaiming silently. Taking somebody tool away without asking generates a ticket, a bad feeling and usually a re-request the same week.

What matters here

  • Never reclaim silently. Ask the holder first, because a silent removal produces a ticket and a re-request within days.
  • Use last meaningful activity, not last login. An SSO session refresh is not usage.
  • Time the whole cycle to the renewal date. Reclaiming after the invoice saves nothing this year.
  • Downgrade before you remove. A viewer seat costs less than an editor seat and keeps the person working.
  • Report the saving in money, not seats. Finance acts on a figure and ignores a seat count.

Who this is for

You run IT operations or finance systems. Software spend grows every renewal, nobody knows which seats are used, and the reclamation project keeps being deferred.

How it works in practice

The sequence, from a seat going unused to the money coming back.

  1. 1

    Seats and last activity are pulled per tool

    From the vendor admin API where one exists, because a licence count without usage is useless.

  2. 2

    Activity is judged on meaningful use

    Not an SSO session refresh, which happens whether or not anybody opened the tool.

  3. 3

    Reclamation runs on the renewal calendar

    Starting well before the notice date, so the seat count can actually change.

  4. 4

    The holder is asked before anything is taken

    With one click to keep it and a reason, which is also the best usage data you will get.

  5. 5

    Downgrade is offered before removal

    A viewer seat is cheaper than an editor seat and keeps somebody productive.

  6. 6

    The saving is reported in money

    To the budget owner, before the renewal negotiation rather than after it.

What reclamation is made of

Four parts, and the second one decides whether anybody cooperates with it.

Per-seat activity

Last meaningful use per user per tool. A seat count with no usage tells you what you bought, not what you need.

Ask before taking

A grace period with one click to keep. A silent removal produces a ticket, a re-request and a reputation.

Renewal timing

The cycle runs before the notice date. Reclaiming after the invoice reduces next year and saves nothing this year.

A saving in money

Reported to the budget owner in currency. Seats reclaimed is an IT metric and finance does not act on it.

The Tray Headless prompts

Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.

Once per project, run /tray-workflows:set-workspace to pick the workspace these build in. Point it at a sandbox first.

  1. 1

    First, find out what usage you can actually see

    Some vendors expose it, some do not, and that shapes everything.

    Headless skills build-workflow tray-patterns

    Use build-workflow. The systems in play are Each vendor admin API,
    Okta, NetSuite, Slack, Workday and Snowflake, or whatever we run in
    those seats. Before you plan anything, tell me which of them are
    already authenticated in the workspace, because I do not want a
    connector stubbed that I have not authenticated.
    
    For each significant SaaS tool, tell me what the vendor admin API
    actually exposes: assigned seats, seat types and prices, and last
    activity per user. That last one is the whole build.
    
    Where a vendor exposes no per-user activity, fall back to SSO sign-in
    events from Okta, and mark those tools as lower confidence. A vendor that
    hides usage data is doing so deliberately and it is worth noting at
    renewal.
    
    Also read the contract: seat count, price per seat type, renewal date and
    notice period. The notice date is what the whole cycle schedules
    against.
  2. 2

    Judge on meaningful activity, not logins

    An SSO refresh is not usage.

    Headless skills build-workflow

    Use build-workflow. Compute per seat: last meaningful activity, activity
    frequency over 90 days, and the seat type and its cost.
    
    Meaningful means something the person did in the tool, not a session
    refresh. An SSO integration frequently records a sign-in whenever a
    browser opens, and counting that as usage makes every seat look active.
    
    Then band them:
    
      Active           used in the last 30 days
      Light            used in 30 to 90 days, and a downgrade candidate
      Dormant          nothing in 90 days
      Never used       assigned and never once opened, which is usually a
                       provisioning default nobody chose
    
    Never used is the easiest money in the exercise and it is almost always
    larger than anybody expects.
  3. 3

    Ask before you take anything

    A silent removal produces a ticket and a re-request the same week.

    For dormant and never-used seats, message the holder before doing
    anything:
    
      Name the tool, when they last used it, and what the seat costs
      Offer one click to keep it, with a short reason
      Offer one click to release it
      Say clearly what happens if they do not reply, and when
    
    Give them two weeks. Copy their manager only at the second reminder.
    
    The reasons people give for keeping a seat are the best usage data you
    will ever collect, and they frequently reveal a tool being used for
    something nobody knew about.
    
    Never reclaim silently. It costs a ticket, a re-request and the
    cooperation you need for the next round.

    "I only use it at quarter end" is the single most common reply, and it is the reason a 90 day window is right and a 30 day one is not.

  4. 4

    Downgrade before you remove, and time it to renewal

    Reclaiming after the invoice saves nothing this year.

    Headless skills tray-gotchas

    Use tray-gotchas, then prefer a downgrade to a removal. A viewer or basic
    seat costs less than a full one and keeps the person working, which is a
    better outcome than a removal followed by a re-request.
    
    Schedule the whole cycle against the renewal:
    
      90 days before notice: run the analysis
      75 days: ask the holders
      60 days: downgrade and reclaim what came back
      45 days: hand the true seat requirement to whoever negotiates
    
    Handle: a leaver whose seat should already have gone through
    offboarding, and if it has not, that is an offboarding failure worth
    reporting; a shared or service account, which should never be reclaimed
    automatically; and a tool where seats cannot be reduced mid-term, where
    the only lever is the renewal itself.
  5. 5

    Report the saving in money

    Finance acts on a figure and ignores a seat count.

    Report per tool and in total: seats assigned, active, light, dormant and
    never used, with the annual cost of each band.
    
    Send the budget owner a number in currency, before the renewal
    negotiation. Two hundred and forty unused seats is an IT observation.
    Ninety thousand a year in unused licences, forty-five days before you
    renegotiate, is a decision.
    
    Also report: seats reclaimed and the saving realised, seats kept after
    being challenged, re-requests within 30 days of a reclamation, and tools
    where usage data is unavailable.
    
    The re-request rate is the honest check on the thresholds. If it is high,
    the dormancy window is too short and you are annoying people to save
    very little.
  6. 6

    Test it, then hand the thresholds to IT and finance

    Because the right dormancy window differs per tool.

    Run the per-step schema checks and the whole-workflow audit before this
    touches production. Run it read-only for one renewal cycle first,
    reporting what it would reclaim without touching anything.
    
    Then open the same workflow in Tray Build so IT and finance can set the
    dormancy windows per tool and adjust the grace period in the visual
    canvas. A design tool used weekly and a tax tool used twice a year need
    different windows.

What it connects to

Usage lives with the vendor, cost lives in finance, and the decision belongs to a person.

Each vendor admin API

Read assigned seats, seat types and last activity per user, which is the data the whole exercise depends on.

Reads and writes

Okta

Fall back to sign-in events where a vendor exposes no usage, and identify leavers who still hold seats.

Reads

NetSuite

Read contract cost, seat pricing and renewal dates, so the saving is reported in money.

Reads

Slack

Ask the holder before anything is taken, with one click to keep, and report the saving to the budget owner.

Writes

Workday

Read leavers, because a leaver still holding a seat is an offboarding failure as well as a cost.

Reads

Snowflake

Land usage and reclamation history, so re-request rate and saving realised are measurable.

Writes

Same build, other stacks

The design does not change if you run something else in one of these seats. The same prompts build it against SAP S/4HANA, Google BigQuery, Microsoft Teams, Azure Active Directory, SAP SuccessFactors or Oracle.

Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.

Running it in production

This removes tools from people and reports savings finance will act on. Both need care.

The platform runs it, not a laptop under a desk

The cycle schedules against each renewal date months ahead, so the analysis lands before the notice period, not after the invoice.

Nothing is reclaimed without a record

Who was asked, what they said, what was taken and when. A disputed reclamation has an answer rather than an argument.

Credentials are managed, never written into the build

Admin access to every SaaS tool in the estate is a broad permission set. Each is an authentication in your workspace, separately scoped and revocable.

IT and finance own the windows

Dormancy thresholds per tool and the grace period open in Tray Build. A tool used twice a year needs a different window from one used daily.

Run read-only for one cycle first

Report what it would reclaim and take nothing. The first read always changes the thresholds and it costs one renewal to learn.

Questions people ask

Why not reclaim silently?

Because it produces a ticket, a re-request within days, and the loss of cooperation you need for the next round. Asking first also collects the best usage data you will get.

Why is last login the wrong measure?

Because SSO integrations frequently record a sign-in whenever a browser opens, whether or not anybody used the tool. Judged on logins, every seat looks active.

Why time it to the renewal?

Because most contracts cannot reduce seats mid-term. Reclaiming after the invoice reduces next year and saves nothing this year, which is usually the year somebody asked about.

Should seats be removed or downgraded?

Downgraded where the tool allows it. A viewer seat costs less and keeps the person working, which beats a removal followed by a re-request a fortnight later.

How should the saving be reported?

In money, to the budget owner, before the renewal negotiation. Two hundred unused seats is an observation; ninety thousand a year, forty-five days before renegotiating, is a decision.

Vibe-coding app guides

Vibe-code an entire app with Helix

This moves the data between systems. It does not give anybody a screen to work in. Build that app in Claude Code, Codex or Cursor, then deploy and run it governed on Tray Helix. Same kind of guide, same kind of prompts.

How to build a SaaS spend tracker (opens helix.tray.ai in a new tab)

Last reviewed September 2026.