NetSuite

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads NetSuite customers, transactions, items and support cases by SuiteQL, so finance and service agents can answer from the ledger and the case history. It signs in with the client’s certificate, machine to machine, and sends only SELECT queries.

At a glance

Collector	NetSuite, version 1.0.0
Reads	Oracle: NetSuite (SuiteTalk REST, SuiteQL) (the vendor's documentation)
Family	ERP
Kind	ERP
Ways to connect	OAuth approval, Key pair
Scopes	Read: rest_webservices
Read only	Yes, except: [object Object]; [object Object]
Vendor's API can move money	No
Personal data	Financial, Identity, Content
Hosts it may contact	*.suitetalk.api.netsuite.com, *.app.netsuite.com, {host}
Vendor API versions	NetSuite REST web services (SuiteQL), OAuth 2.0 client credentials (M2M)
Lowest engine version	0.46.0

What it reads

• Four kinds, which you choose: customers, transactions, items and cases, with the business record’s columns (names, status, terms, totals, currency, memo, dates). A customer’s email and phone are not read.
• Changes since the cursor: SuiteQL’s lastmodifieddate is in the account’s time zone with no offset, so the query starts a day before the cursor, the time is read as written (as UTC), and what is not newer is dropped.
• SuiteQL’s offset paging stops at 100,000 rows, so a larger first pull starts again from the newest time it has read, skipping ids already read, until a restart brings nothing new. The listing for a reconcile pages by id.
• Deletions: every six hours the ids are listed (ids only) and what has gone is withdrawn. A record type the role cannot read (400, 403) keeps its ids.

How to connect

1. In NetSuite, create an integration record with the OAuth 2.0 client-credentials grant, generate a certificate, and upload it under Setup, Integration, OAuth 2.0 Client Credentials (M2M) Setup, mapped to a role that only views the records named.
2. In LightHouse, open Connectors, choose NetSuite, and give the client id, the certificate’s id and the certificate’s private key (PEM). They are sealed in your browser to your deployment’s key and kept in your own secrets store; LightHouse never opens them.
3. In code, set NETSUITE_CREDENTIAL to the credential’s JSON fields (account_id, client_id, certificate_id, certificate) and add a kind: netsuite source card with objects, label and requires.

Permissions

The rest_webservices scope, with a mapped role that has view permission on the records named and nothing that creates or edits; read and write is not offered. The deployment signs a five-minute assertion (PS256, the certificate’s id as kid) and NetSuite answers an hour’s token. No password and no token-based-authentication secret pair is asked for.

Every request goes to the account’s own host, <account>.suitetalk.api.netsuite.com, made from the sealed account id, and the fetcher refuses any other. The only POSTs are the token request and SuiteQL, which carries its query in a POST body; both are listed in the manifest’s read_operations, and the read-only test asserts they are the only paths used and that every query is a SELECT.

Limits

• account_id is the NetSuite account id (for example 1234567 or 1234567_SB1).
• Only the four kinds are read, with fixed columns.
• Offset paging is capped at 100,000 rows by SuiteQL; the collector restarts from the newest time and skips ids read.
• A re-read of a day’s changes is normal, because of the time-zone widening.
• Requests are paced and back off when NetSuite asks (Retry-After).

Data handling

• Records are copied into the deployment’s corpus under the source’s label. They are financial records and name customers and suppliers (companies, and some people); a customer’s email and phone are not read.
• The private key stays in the client’s store; only a five-minute assertion is signed and sent, and an hour’s token is held in memory. Neither is written to logs or run notes.
• Nothing leaves the deployment: only counts reach LightHouse.

Troubleshooting

What you see	What it means	What to do
account_id is your NetSuite account id, e.g. 1234567 or 1234567_SB1	The account id is not NetSuite’s	Use the account id from Setup, Company, Company Information
the NetSuite certificate holds no readable private key	The pasted PEM has no private key	Paste the private key and the certificate
NetSuite answered no access token	The token request was accepted but gave no token	Check the integration record and the certificate mapping
HTTP 400 or HTTP 401 on the token request	The client id, certificate id or mapped role is wrong	Check the M2M setup
HTTP 403 on a query	The role cannot view that record type	Grant view permission; its ids are kept meanwhile
Read succeeded, 0 written	No record changed since the cursor	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	NetSuite REST web services, SuiteQL, OAuth 2.0 client credentials (M2M)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only