Automation · IT and security
How to build SaaS licence reclamation
Renewal arrives for four hundred seats and about half of them belong to people who have not signed in since March. This is the design behind reclaiming them, the prompts that build it, and what production adds.
Built with Tray Headless
- System Vendor admin API
- Step Last active per seat
- Step Ask the holder
- Step Reclaim on schedule
- System Okta
Nobody loses a seat without being asked first, and reclamation runs before the renewal rather than after the invoice.
The short answer
What is SaaS licence reclamation?
There are four parts to licence reclamation: last-active data pulled per seat instead of per account, a grace period where the holder is asked before anything is taken, reclamation timed to run before renewal instead of after the invoice, and the saving reported where finance can act on it. The common failure is reclaiming silently. Taking somebody tool away without asking generates a ticket, a bad feeling and usually a re-request the same week.
What matters here
- Never reclaim silently. Ask the holder first, because a silent removal produces a ticket and a re-request within days.
- Use last meaningful activity, not last login. An SSO session refresh is not usage.
- Time the whole cycle to the renewal date. Reclaiming after the invoice saves nothing this year.
- Downgrade before you remove. A viewer seat costs less than an editor seat and keeps the person working.
- Report the saving in money, not seats. Finance acts on a figure and ignores a seat count.
Who this is for
You run IT operations or finance systems. Software spend grows every renewal, nobody knows which seats are used, and the reclamation project keeps being deferred.
How it works in practice
The sequence, from a seat going unused to the money coming back.
- 1
Seats and last activity are pulled per tool
From the vendor admin API where one exists, because a licence count without usage is useless.
- 2
Activity is judged on meaningful use
Not an SSO session refresh, which happens whether or not anybody opened the tool.
- 3
Reclamation runs on the renewal calendar
Starting well before the notice date, so the seat count can actually change.
- 4
The holder is asked before anything is taken
With one click to keep it and a reason, which is also the best usage data you will get.
- 5
Downgrade is offered before removal
A viewer seat is cheaper than an editor seat and keeps somebody productive.
- 6
The saving is reported in money
To the budget owner, before the renewal negotiation rather than after it.
What reclamation is made of
Four parts, and the second one decides whether anybody cooperates with it.
Per-seat activity
Last meaningful use per user per tool. A seat count with no usage tells you what you bought, not what you need.
Ask before taking
A grace period with one click to keep. A silent removal produces a ticket, a re-request and a reputation.
Renewal timing
The cycle runs before the notice date. Reclaiming after the invoice reduces next year and saves nothing this year.
A saving in money
Reported to the budget owner in currency. Seats reclaimed is an IT metric and finance does not act on it.
The Tray Headless prompts
Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.
Once per project, run
/tray-workflows:set-workspace
to pick the workspace these build in. Point it at a sandbox first.
- 1
First, find out what usage you can actually see
Some vendors expose it, some do not, and that shapes everything.
Headless skills
build-workflowtray-patternsUse build-workflow. The systems in play are Each vendor admin API, Okta, NetSuite, Slack, Workday and Snowflake, or whatever we run in those seats. Before you plan anything, tell me which of them are already authenticated in the workspace, because I do not want a connector stubbed that I have not authenticated. For each significant SaaS tool, tell me what the vendor admin API actually exposes: assigned seats, seat types and prices, and last activity per user. That last one is the whole build. Where a vendor exposes no per-user activity, fall back to SSO sign-in events from Okta, and mark those tools as lower confidence. A vendor that hides usage data is doing so deliberately and it is worth noting at renewal. Also read the contract: seat count, price per seat type, renewal date and notice period. The notice date is what the whole cycle schedules against.
- 2
Judge on meaningful activity, not logins
An SSO refresh is not usage.
Headless skills
build-workflowUse build-workflow. Compute per seat: last meaningful activity, activity frequency over 90 days, and the seat type and its cost. Meaningful means something the person did in the tool, not a session refresh. An SSO integration frequently records a sign-in whenever a browser opens, and counting that as usage makes every seat look active. Then band them: Active used in the last 30 days Light used in 30 to 90 days, and a downgrade candidate Dormant nothing in 90 days Never used assigned and never once opened, which is usually a provisioning default nobody chose Never used is the easiest money in the exercise and it is almost always larger than anybody expects. - 3
Ask before you take anything
A silent removal produces a ticket and a re-request the same week.
For dormant and never-used seats, message the holder before doing anything: Name the tool, when they last used it, and what the seat costs Offer one click to keep it, with a short reason Offer one click to release it Say clearly what happens if they do not reply, and when Give them two weeks. Copy their manager only at the second reminder. The reasons people give for keeping a seat are the best usage data you will ever collect, and they frequently reveal a tool being used for something nobody knew about. Never reclaim silently. It costs a ticket, a re-request and the cooperation you need for the next round.
"I only use it at quarter end" is the single most common reply, and it is the reason a 90 day window is right and a 30 day one is not.
- 4
Downgrade before you remove, and time it to renewal
Reclaiming after the invoice saves nothing this year.
Headless skills
tray-gotchasUse tray-gotchas, then prefer a downgrade to a removal. A viewer or basic seat costs less than a full one and keeps the person working, which is a better outcome than a removal followed by a re-request. Schedule the whole cycle against the renewal: 90 days before notice: run the analysis 75 days: ask the holders 60 days: downgrade and reclaim what came back 45 days: hand the true seat requirement to whoever negotiates Handle: a leaver whose seat should already have gone through offboarding, and if it has not, that is an offboarding failure worth reporting; a shared or service account, which should never be reclaimed automatically; and a tool where seats cannot be reduced mid-term, where the only lever is the renewal itself.
- 5
Report the saving in money
Finance acts on a figure and ignores a seat count.
Report per tool and in total: seats assigned, active, light, dormant and never used, with the annual cost of each band. Send the budget owner a number in currency, before the renewal negotiation. Two hundred and forty unused seats is an IT observation. Ninety thousand a year in unused licences, forty-five days before you renegotiate, is a decision. Also report: seats reclaimed and the saving realised, seats kept after being challenged, re-requests within 30 days of a reclamation, and tools where usage data is unavailable. The re-request rate is the honest check on the thresholds. If it is high, the dormancy window is too short and you are annoying people to save very little.
- 6
Test it, then hand the thresholds to IT and finance
Because the right dormancy window differs per tool.
Run the per-step schema checks and the whole-workflow audit before this touches production. Run it read-only for one renewal cycle first, reporting what it would reclaim without touching anything. Then open the same workflow in Tray Build so IT and finance can set the dormancy windows per tool and adjust the grace period in the visual canvas. A design tool used weekly and a tax tool used twice a year need different windows.
What it connects to
Usage lives with the vendor, cost lives in finance, and the decision belongs to a person.
Each vendor admin API
Read assigned seats, seat types and last activity per user, which is the data the whole exercise depends on.
Reads and writes
Okta
Fall back to sign-in events where a vendor exposes no usage, and identify leavers who still hold seats.
Reads
NetSuite
Read contract cost, seat pricing and renewal dates, so the saving is reported in money.
Reads
Slack
Ask the holder before anything is taken, with one click to keep, and report the saving to the budget owner.
Writes
Workday
Read leavers, because a leaver still holding a seat is an offboarding failure as well as a cost.
Reads
Snowflake
Land usage and reclamation history, so re-request rate and saving realised are measurable.
Writes
Same build, other stacks
The design does not change if you run something else in one of these seats. The same prompts build it against SAP S/4HANA, Google BigQuery, Microsoft Teams, Azure Active Directory, SAP SuccessFactors or Oracle.
Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.
Running it in production
This removes tools from people and reports savings finance will act on. Both need care.
The platform runs it, not a laptop under a desk
The cycle schedules against each renewal date months ahead, so the analysis lands before the notice period, not after the invoice.
Nothing is reclaimed without a record
Who was asked, what they said, what was taken and when. A disputed reclamation has an answer rather than an argument.
Credentials are managed, never written into the build
Admin access to every SaaS tool in the estate is a broad permission set. Each is an authentication in your workspace, separately scoped and revocable.
IT and finance own the windows
Dormancy thresholds per tool and the grace period open in Tray Build. A tool used twice a year needs a different window from one used daily.
Run read-only for one cycle first
Report what it would reclaim and take nothing. The first read always changes the thresholds and it costs one renewal to learn.
Questions people ask
Why not reclaim silently?
Because it produces a ticket, a re-request within days, and the loss of cooperation you need for the next round. Asking first also collects the best usage data you will get.
Why is last login the wrong measure?
Because SSO integrations frequently record a sign-in whenever a browser opens, whether or not anybody used the tool. Judged on logins, every seat looks active.
Why time it to the renewal?
Because most contracts cannot reduce seats mid-term. Reclaiming after the invoice reduces next year and saves nothing this year, which is usually the year somebody asked about.
Should seats be removed or downgraded?
Downgraded where the tool allows it. A viewer seat costs less and keeps the person working, which beats a removal followed by a re-request a fortnight later.
How should the saving be reported?
In money, to the budget owner, before the renewal negotiation. Two hundred unused seats is an observation; ninety thousand a year, forty-five days before renegotiating, is a decision.
Vibe-coding app guides
Vibe-code an entire app with Helix
This moves the data between systems. It does not give anybody a screen to work in. Build that app in Claude Code, Codex or Cursor, then deploy and run it governed on Tray Helix. Same kind of guide, same kind of prompts.
How to build a SaaS spend tracker (opens helix.tray.ai in a new tab)
Related guides
IT and security
How to build access request and approval
Route to the system owner, grant with an expiry by default, provision automatically, and produce the access review as a by-product. The prompts that build it.
People operations
How to build employee offboarding deprovisioning
Revoke on the leave date, cover every system instead of the ones you remember, transfer what they owned, and prove it. The Headless prompts that build it.
IT and security
How to build a device lifecycle sync
Reconcile what management sees against what finance owns and what HR says, and make an unassigned device an exception instead of a row. The prompts.
Last reviewed September 2026.