# NetSuite > NetSuite: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads NetSuite customers, transactions, items and support cases by SuiteQL, so finance and service agents can answer from the ledger and the case history. It signs in with the client’s certificate, machine to machine, and sends only SELECT queries. ## At a glance | Collector | NetSuite, version `1.0.0` | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | Oracle: NetSuite (SuiteTalk REST, SuiteQL) ([the vendor's documentation](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_1540391670.html)) | | Family | ERP | | Kind | ERP | | Ways to connect | OAuth approval, Key pair | | Scopes | - Read: `rest_webservices` | | Read only | Yes, except: \[object Object]; \[object Object] | | Vendor's API can move money | No | | Personal data | Financial, Identity, Content | | Hosts it may contact | `*.suitetalk.api.netsuite.com`, `*.app.netsuite.com`, `{host}` | | Vendor API versions | NetSuite REST web services (SuiteQL), OAuth 2.0 client credentials (M2M) | | Lowest engine version | `0.46.0` | ## What it reads - Four kinds, which you choose: `customers`, `transactions`, `items` and `cases`, with the business record’s columns (names, status, terms, totals, currency, memo, dates). A customer’s email and phone are not read. - Changes since the cursor: SuiteQL’s `lastmodifieddate` is in the account’s time zone with no offset, so the query starts a day before the cursor, the time is read as written (as UTC), and what is not newer is dropped. - SuiteQL’s offset paging stops at 100,000 rows, so a larger first pull starts again from the newest time it has read, skipping ids already read, until a restart brings nothing new. The listing for a reconcile pages by id. - Deletions: every six hours the ids are listed (ids only) and what has gone is withdrawn. A record type the role cannot read (400, 403) keeps its ids. ## How to connect 1. In NetSuite, create an integration record with the OAuth 2.0 client-credentials grant, generate a certificate, and upload it under **Setup, Integration, OAuth 2.0 Client Credentials (M2M) Setup**, mapped to a role that only views the records named. 2. In LightHouse, open **Connectors**, choose **NetSuite**, and give the client id, the certificate’s id and the certificate’s private key (PEM). They are sealed in your browser to your deployment’s key and kept in your own secrets store; LightHouse never opens them. 3. In code, set `NETSUITE_CREDENTIAL` to the credential’s JSON fields (`account_id`, `client_id`, `certificate_id`, `certificate`) and add a `kind: netsuite` source card with `objects`, `label` and `requires`. ## Permissions The `rest_webservices` scope, with a mapped role that has view permission on the records named and nothing that creates or edits; read and write is not offered. The deployment signs a five-minute assertion (PS256, the certificate’s id as `kid`) and NetSuite answers an hour’s token. No password and no token-based-authentication secret pair is asked for. Every request goes to the account’s own host, `.suitetalk.api.netsuite.com`, made from the sealed account id, and the fetcher refuses any other. The only POSTs are the token request and SuiteQL, which carries its query in a POST body; both are listed in the manifest’s `read_operations`, and the read-only test asserts they are the only paths used and that every query is a SELECT. ## Limits - `account_id` is the NetSuite account id (for example `1234567` or `1234567_SB1`). - Only the four kinds are read, with fixed columns. - Offset paging is capped at 100,000 rows by SuiteQL; the collector restarts from the newest time and skips ids read. - A re-read of a day’s changes is normal, because of the time-zone widening. - Requests are paced and back off when NetSuite asks (`Retry-After`). ## Data handling - Records are copied into the deployment’s corpus under the source’s `label`. They are financial records and name customers and suppliers (companies, and some people); a customer’s email and phone are not read. - The private key stays in the client’s store; only a five-minute assertion is signed and sent, and an hour’s token is held in memory. Neither is written to logs or run notes. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | --------------------------------------------------------------------- | ----------------------------------------------------- | ----------------------------------------------------------- | | `account_id is your NetSuite account id, e.g. 1234567 or 1234567_SB1` | The account id is not NetSuite’s | Use the account id from Setup, Company, Company Information | | `the NetSuite certificate holds no readable private key` | The pasted PEM has no private key | Paste the private key and the certificate | | `NetSuite answered no access token` | The token request was accepted but gave no token | Check the integration record and the certificate mapping | | `HTTP 400` or `HTTP 401` on the token request | The client id, certificate id or mapped role is wrong | Check the M2M setup | | `HTTP 403` on a query | The role cannot view that record type | Grant view permission; its ids are kept meanwhile | | Read succeeded, 0 written | No record changed since the cursor | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ----------------------------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | NetSuite REST web services, SuiteQL, OAuth 2.0 client credentials (M2M) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/netsuite/