Oracle NetSuite

Oracle NetSuite

This connector works with one NetSuite account through SuiteTalk REST Web Services (https://<account>.suitetalk.api.netsuite.com/services/rest): SuiteQL queries (/query/v1/suiteql), the record API (/record/v1) for reading records with their sublists and for creating customers and sales orders, and the metadata catalog that describes every record type and its fields. It runs as the NetSuite user and role chosen at sign-in, with that role's permissions.

Setup (one-time, about 20 minutes, as an administrator)

1. Enable features: Setup → Company → Enable Features. On the SuiteCloud subtab tick REST Web Services and, under Manage Authentication, OAuth 2.0. On the Analytics subtab tick SuiteAnalytics Workbook, which SuiteQL reads from. Save.
2. Role: Setup → Users/Roles → Manage Roles → New (or customize an existing role). On Permissions → Setup add REST Web Services (Full) and Log in using OAuth 2.0 Access Tokens (Full). Add View on the lists and transactions the AI may read (Lists: Customers, Vendors, Items, Employees, Accounts; Transactions: Sales Order, Invoice, Purchase Order, Bills, Make Journal Entry, Find Transaction) and Create where it may write (Customers, Sales Order). Give the role to the user who will authorize the connector. Use a dedicated role rather than Administrator, so the AI sees only what it needs.
3. Integration record: Setup → Integration → Manage Integrations → New. Give it a name, State Enabled, untick Token-Based Authentication and TBA: Authorization Flow. Under OAuth 2.0 tick Authorization Code Grant, leave Public Client unticked, set the Redirect URI to https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud (or <your AnythingMCP URL>/api/mcp-oauth/callback when you host AnythingMCP yourself) and tick the scope REST Web Services. Save: the Client ID and Client Secret are shown once, at the bottom of the page. Paste them into NETSUITE_CLIENT_ID and NETSUITE_CLIENT_SECRET.
4. Account ID: Setup → Company → Company Information → Account ID (for example 1234567, or 1234567_SB1 for a sandbox). NETSUITE_ACCOUNT_ID takes it the way it appears in your NetSuite web address: lowercase, with a hyphen instead of the underscore, e.g. 1234567 or 1234567-sb1 (from https://1234567-sb1.app.netsuite.com). An integration record created in production is copied to a sandbox only by a sandbox refresh; for a sandbox, create the record in the sandbox itself.
5. Install, click Authorize with Provider, sign in to NetSuite and pick the role from step 2 on the consent page. AnythingMCP signs the request with PKCE (which NetSuite requires for new integrations from release 2027.1) and exchanges the code with HTTP Basic client authentication.
6. Run netsuite_list_record_types to check the connection, then a first query such as SELECT id, companyname FROM customer with netsuite_suiteql_query.

Tokens: access tokens last 60 minutes and are renewed automatically. NetSuite keeps the refresh token of an integration like this one valid for seven days and does not replace it when it is used, so the connector has to be authorized again (Authorize with Provider) at least once a week. Disabling the integration record, the role or the user ends access at once.

SuiteQL (netsuite_suiteql_query) is the main tool: one read-only SQL query over the NetSuite analytics schema. Tips:

• Tables: customer, vendor, employee, contact, item, account, subsidiary, department, classification, location, currency, accountingperiod, transaction (header) with transactionline (lines, transactionline.transaction = transaction.id) and transactionaccountingline (posting amounts per account).
• transaction.type codes: SalesOrd, CustInvc, CustPymt, CustCred, Estimate, PurchOrd, VendBill, VendPymt, Journal, ItemShip, ItemRcpt. On transactionline, mainline = 'F' keeps the item lines and drops the header line.
• BUILTIN.DF(field) returns the display text of a list or record field, e.g. BUILTIN.DF(entity) for the customer name, BUILTIN.DF(status). Dates: trandate >= TO_DATE('2026-01-01', 'YYYY-MM-DD'). Booleans are 'T' and 'F'.
• Column names come back in lowercase. Custom fields keep their script ids (custentity_..., custbody_..., custcol_...).
• Paging: limit (1 to 1000, default 100) and offset; keep offset a multiple of limit and add an ORDER BY on a unique column so pages neither repeat nor skip rows. hasMore and totalResults tell whether there is more. A query returns at most 100,000 rows in total; aggregate with GROUP BY instead of paging through large sets.
• Rows the role may not see are left out silently, so an empty answer can mean a missing permission.

Record API: netsuite_get_record reads any record type by internal id (eid:<external id> works too); the dedicated tools read customers, vendors, employees, items, sales orders, invoices, purchase orders, vendor bills and journal entries. Transactions are returned with their lines (item.items[], expense.items[], line.items[]) expanded. Record type names are camelCase (salesOrder, vendorBill, inventoryItem); netsuite_list_record_types lists them and netsuite_describe_record_type returns every field of one, including custom fields. netsuite_list_records lists internal ids only, filtered with the record API's own q syntax.

Writes: confirm first.

• netsuite_create_customer creates a customer. In a OneWorld account pass subsidiary as {"id": "<subsidiary id>"}. The answer has no body: the new record's address, with its internal id at the end, is in the location header.
• netsuite_create_sales_order (installed switched off) creates a sales order for an existing customer, by default in status Pending Approval (A).
• netsuite_update_record (installed switched off) changes fields of any record. Changes to posted transactions affect the books.

Common errors

• 400 or 401 with INVALID_LOGIN ("Invalid login attempt"): the token expired and could not be renewed (the weekly refresh limit), or the integration, role or user was disabled. Authorize again.
• 403 or INSUFFICIENT_PERMISSION: the role lacks a permission (REST Web Services, Log in using OAuth 2.0 Access Tokens, or the record's own permission).
• 400 INVALID_PARAMETER or a SuiteQL syntax error: check the query, the field names (netsuite_describe_record_type) and the paging.
• 429 or CONCURRENCY_LIMIT_EXCEEDED: the account's limit on parallel web service requests is reached; wait and retry one call at a time.
• An unknown host: NETSUITE_ACCOUNT_ID is not in the web address form (lowercase, hyphen).

Not supported: Token-Based Authentication (TBA, OAuth 1.0a): NetSuite stops accepting new TBA integrations with release 2027.1, and this connector uses OAuth 2.0 only. Also out of scope: deleting records, saved searches and reports, RESTlets, file cabinet, and the SOAP API.