Apideck CLI: Query 200+ SaaS APIs from your terminal. No SDK needed. Read more

Apideck Documentation Page

Connect to NetSuite

This guide will walk you through the process of setting up NetSuite User Roles to get Access Tokens using Token-Based Authentication. Access tokens are used to authenticate requests to NetSuite APIs, which enables you to integrate NetSuite with other applications.

By following these steps, you can grant specific NetSuite User Roles access to generate Access Tokens and use them to access NetSuite APIs securely.

Steps:

  1. Create a role with the right permissions

  2. Assign the role to a new user

  3. Create an application

  4. Create access tokens

  5. Find your Account ID

  6. Configure the Netsuite connection

Info: This guide assumes you have a basic understanding of NetSuite and its interface.

Create a new User role

To grant access to the Netsuite, you need to create a user role to get Access Tokens using Token-Based Authentication

  1. User Roles to get Access Tokens using Token-Based Authentication:

  2. Log in to your NetSuite account as an administrator.

  3. Go to Setup > Users/Roles > Manage Roles.netsuite new role

  4. Click on the 'New' button to create a new role. netsuite role formGive the role a name (e.g. Integration Role).

  5. Under the 'Permissions' tab, select the appropriate permissions that you want to grant to this role. netsuite role permissionsNote that the role must have the necessary permissions to perform the tasks that the integration will be used for.

    We recommend to review the permission levels for the various sections:

    For "Transactions","Lists" we recommend to set the permission to "View" to allow reading data and "Full" to allow creating and/or modifying data. For "Lists","Currencies" we recommend to set the permission to "View" to allow reading data and "Full" to allow creating and/or modifying data. For "Setup", the only option is "None" or "Full", please set it to "Full" to grant access to the Netsuite instance.

    For more details about the Netsuite permission levels, please refer to the Access Levels page in NetSuite Help Center.

    Important for Projects Functionality: To enable customer-to-project mapping and full project management features, ensure the following permissions are granted:

    • Lists > Projects: Required for accessing job/project records
    • Transactions > Time Entry/Time Tracking: Needed for project time management
    • Lists > Customers: Required for customer-project relationship mapping

    Important for Financial Reports (Profit & Loss, Balance Sheet): These reports use the SOAP getPostingTransactionSummary API which only requires "Financial Statements" permission. Ensure the following permission is granted:

    • Reports > Financial Statements: View access required for financial report queries
    • Lists > Accounts: View access for chart of accounts data (used for account name enrichment)

    Important for filtered list calls (SuiteQL access): any list call with a filter[*] parameter (e.g. filter[updated_since], filter[id_since]) on invoices, bills, or credit-notes is routed through NetSuite's REST/SuiteQL endpoint instead of SOAP. SuiteQL has its own access checks on every table touched by the query (the transaction table plus the customer JOIN), so on top of the standard Setup permissions the role must include:

    PERMISSIONAREALEVEL
    SuiteAnalytics WorkbookReportsEdit
    Find TransactionTransactionsView
    Invoice / Bill / Credit MemoTransactionsView (per resource used)
    CustomersListsView

    The address subrecords joined into the invoice list (transactionBillingAddress, transactionShippingAddress) inherit access from the parent transaction record — there is no separate Lists > Address permission to grant.

    If a permission is missing, NetSuite does not say which one in a single response. Each missing permission produces a distinct symptom:

    What's missingSymptom on filtered list calls
    SuiteAnalytics Workbook400 Bad Request — Invalid search query. Your current role does not have permission to perform this action.
    Find Transaction400 Bad Request — Invalid search query. Search error occurred: Record 'transaction' was not found.
    Customers400 Bad Request — Invalid search query. Search error occurred: Record 'customer' was not found.
    Invoice / Bill / Credit Memo (per type)200 OK with data: [] — query succeeds but every row of the corresponding type is silently filtered out, so the integration looks healthy while returning nothing

    The Setup permissions REST Web Services, SOAP Web Services and Log in using Access Tokens are needed for any Apideck connection (Apideck validates the connection through a SOAP call before any SuiteQL request runs); they are listed in the Setup table further below. Non-filter list calls and GET /accounting/{resource}/{id} calls go through SOAP and don't require SuiteAnalytics Workbook or Find Transaction.

    See Syncing large NetSuite transaction datasets for why filtered list calls are the recommended path for large datasets.

    Transactions

    TRANSACTIONS PERMISSIONLEVEL
    Access Payment Audit LogView/Full
    Audit TrailView/Full
    Automated Cash ApplicationView/Full
    Bill Purchase OrdersView/Full
    BillsView/Full
    Calculate TimeView/Full
    Cash SaleView/Full
    Cash Sale RefundView/Full
    CheckView/Full
    Credit CardView/Full
    Credit Card RefundView/Full
    Credit MemoView/Full
    Credit ReturnsView/Full
    Customer DepositView/Full
    Customer PaymentView/Full
    Customer RefundView/Full
    DepositView/Full
    Deposit ApplicationView/Full
    Edit ForecastView/Full
    Enter Opening BalancesView/Full
    Enter Vendor CreditsView/Full
    EstimateView/Full
    Expense ReportView/Full
    Finance ChargeView/Full
    Find TransactionView/Full
    Fulfill OrdersView/Full
    Generate Price ListsView/Full
    Generate StatementsView/Full
    Import Online Banking FileView/Full
    InvoiceView/Full
    Invoice ApprovalView/Full
    Invoice Sales OrdersView/Full
    Item FulfillmentView/Full
    Item ReceiptView/Full
    Make Journal EntryView/Full
    Matching Rules for Online BankingView/Full
    OpportunityView/Full
    Pay BillsView/Full
    PaymentsView/Full
    Pay Sales TaxView/Full
    Post Vendor Bill VariancesView/Full
    Posting Period on TransactionsView/Full
    Purchase OrderView/Full
    Receive OrderView/Full
    Receive ReturnsView/Full
    ReconcileEdit
    Refund ReturnsView/Full
    Return Auth. ApprovalView/Full
    Return AuthorizationView/Full
    Sales OrderView/Full
    Sales Order ApprovalView/Full
    Set Up BudgetsView/Full
    Statement ChargeView/Full
    System JournalView/Full
    TimerView/Full
    Time EntryView/Full
    Time TrackingView/Full
    Track TimeView/Full
    Transfer FundsView/Full
    Vendor Bill ApprovalView/Full
    Vendor Payment ApprovalView/Full
    Vendor Return Auth. ApprovalView/Full
    Vendor Return AuthorizationView/Full
    Vendor ReturnsView/Full
    View Gateway Asynchronous NotificationsView/Full
    View Payment EventsView/Full

    Reports

    REPORTS PERMISSIONSLEVEL
    SuiteAnalytics WorkbookEdit
    Financial StatementsView

    List

    LISTS PERMISSIONSLEVEL
    AccountsView/Full
    ClassesView/Full
    CompaniesView/Full
    ContactsView/Full
    CurrencyView/Full
    CustomersView/Full
    Documents and FilesView/Full
    DepartmentsView/Full
    ItemsView/Full
    LocationsView/Full
    ProjectsView/Full
    SubsidiariesView/Full
    Tax RecordsView/Full
    VendorsView/Full

    Setup

    SETUP PERMISSIONSLEVEL
    Accounting ListsFull
    Accounting ManagementFull
    Deleted RecordsFull
    Log in using Access TokensFull
    Other ListsFull
    REST Web ServicesFull
    SOAP Web ServicesFull

    Note: Financial reports (Profit & Loss, Balance Sheet) use the SOAP getPostingTransactionSummary API which only requires the Financial Statements permission under Reports. This is a less restrictive permission than SuiteQL which requires "SuiteAnalytics Workbook". Without Financial Statements permission, these endpoints will return 401 Unauthorized errors.

Assign a user to the role

It is recommended that you create a separate user for this purpose instead of assigning the role to an existing user. It helps with better tracking and auditing operations.

  1. Click Lists > Employees > New

  2. Enter the employee details (e.g. Integration User), and email address. netsuite employees new

  3. Click Access tab netsuite employees access

    • select Give Access.

    • Enable Manually Assign or Change Password and specify a password.

  4. Under Roles, select the role that you created in Step "Create a new User role" from the drop down list (e.g. Integration Role) and click Add. netsuite employees roles

Create an Application

Once the role is set up, you can follow these steps to generate the consumer Key & Secret:

  1. Log in to your NetSuite account with a user who has been assigned the role (e.g Integration Role) that has access.

  2. Go to Setup > Integrations > Manage integrations.

  3. Click the 'New' button to create a new integration or select an existing integration that you want to use. netsuite integrations form

    • Name: Enter a meaningful name (for example, Integration App)
    • Authentication: Under the 'Authentication' section,
      • select 'Token-Based Authentication.'
      • For TBA: Authorization flow set https://unify.apideck.com/vault/callback as callback URL.
    • Oauth 2.0: Under the 'Oauth 2.0**' section,
      • Check "Authorization Code grant"
      • Check "REST API services"
      • Set https://unify.apideck.com/vault/callback as the redirect URI.

    Click the 'Save' button to save the changes.

  4. Once saved, the Consumer Key and Consumer Secret will be generated.

    💡 REMARK: Copy the "Consumer Key" and the "Consumer secret". You can not access this information once you exit this screen.netsuite integrations consumer id secret

Create Access tokens

Create a New Access Token with the Role just created.

  1. Go to Setup > Users/Roles > Access Tokens.

  1. Click the 'New' button to create a new Access token

  2. Complete the form

    netsuite access token form

    • Select the "Application name" that you have created in the previous step (e.g. Integration App).

    • Select the "User", which we created in the previous steps (e.g. Integration User)

    • Give the token a recognizable "token name", for example Integration Token

    • Click the 'Save' button to save the changes.

4- Once saved, the Account Token ID and Secret will be generated.

💡 REMARK: Copy the "Token Id" and the "Token secret". You can not access this information once you exit this screen.netsuite access token id secret

Find your Account ID

  1. Go to Setup > Company > Company Information

  2. Copy the Account ID

netsuite account id

Configure the Netsuite connection

Enter the Account ID, Consumer Key, Consumer Secret, Token ID and Token Secret to get started with the integration.

Bank Feeds (optional)

If you want to push bank statements into NetSuite's Match Bank Data workflow through the Unify bank-feed-statements endpoint, a small amount of extra setup is needed on top of the standard connection above.

At a glance:

  1. Install the Apideck Bank Feed bundle in your NetSuite account. Your Apideck contact will share the bundle ID and installation instructions.

  2. Install the NetSuite Bank Statement Parsers SuiteApp (bundle ID 293699, published by Oracle NetSuite, free). This provides the CSV parser that the Apideck bundle feeds into. Install it from Customization → SuiteBundler → Search & Install Bundles.

  3. Create a Format Profile (Setup → Accounting → Financial Institution → Format Profiles) linking the Apideck connectivity plug-in to the NetSuite bank accounts you want to feed.

  4. Provide two extra connection fields in the Apideck Vault for your NetSuite connection:

    • Bank Feed RESTlet Script ID
    • Bank Feed RESTlet Deploy ID

    You can find both under Customization → Scripting → Scripts → Apideck Bank Feed RESTlet, on the Deployments tab. Each row's External URL contains script=<numeric_id> and deploy=<numeric_id> — those are the values to paste into the Vault.

The full walkthrough — required permissions, Format Profile field mapping and formatting preferences, account linking, day-to-day operations and troubleshooting — is in the dedicated Apideck Bank Feed for NetSuite setup guide. You only need that guide if you intend to use the bank-feed-statements endpoint; regular NetSuite integrations don't require any of these steps.