Skip to main content
Connect your agent to NetSuite to read and update your ERP data — customers, vendors, invoices, sales orders, purchase orders, vendor bills, and any other record type. The agent can call any NetSuite REST API endpoint and run SuiteQL queries, so anything your integration role can do in NetSuite, the agent can do too.

​
How to enable

Go to Settings → Capabilities and enable NetSuite, then link a workspace secret containing your NetSuite Account ID, Client ID, Certificate ID, and private key (setup below). The same secret can be reused across agents and teams.

​
Example use cases

  • Invoice monitoring — “Every morning, list invoices that became overdue yesterday and email me a summary per customer”
  • Vendor bill triage — “When you receive a supplier invoice by email, look up the vendor in NetSuite and check for an open purchase order that matches”
  • Month-end reporting — “On the 3rd of every month, send me last month’s consolidated income statement next to the same month last year”
  • Ad hoc analysis — “Run a SuiteQL query summing this month’s sales orders by subsidiary and post the result to the #finance Slack channel”
  • Data hygiene — “Find customers missing a payment-terms value and report them to me”

​
How to set up NetSuite authentication

NetSuite uses the OAuth 2.0 client credentials (machine-to-machine) flow with certificate authentication. The agent authenticates as a NetSuite integration mapped to a role you choose, so everything the agent does is limited to — and audited under — that role’s permissions.
1

Enable the required features

In NetSuite, go to Setup → Company → Enable Features → SuiteCloud and enable REST Web Services and OAuth 2.0.
2

Create a role for the agent

Create a dedicated role (Setup → Users/Roles → Manage Roles → New) with:
  • Log in using OAuth 2.0 Access Tokens (under Permissions → Setup)
  • REST Web Services (under Permissions → Setup)
  • The record permissions the agent needs (e.g. Customers, Invoices — view only, or full)
Assign the role to a user (a dedicated integration employee record is recommended).
Give the role only the record types and access levels the agent actually needs. NetSuite enforces these permissions on every request — a read-only role makes the agent read-only, guaranteed.
3

Create an integration record

Go to Setup → Integration → Manage Integrations → New:
  • Name: e.g. “Abundly Agent”
  • Under Authentication, check OAuth 2.0 with the Client Credentials (Machine to Machine) Grant, and check REST Web Services under scope
  • Uncheck Authorization Code Grant and the Token-Based Authentication options
You don’t need a Redirect URI. The agent signs in without a browser, so it never uses one. If NetSuite asks for one, make sure Authorization Code Grant is unchecked.
When you save, NetSuite shows the Consumer Key / Client ID once — copy it now.
4

Generate a certificate key pair

On your machine, generate an RSA key pair and a self-signed certificate (valid at most 2 years):
Keep netsuite-key.pem (the private key) safe — you’ll paste it into Abundly. netsuite-cert.pem is uploaded to NetSuite in the next step.
Use an RSA key (as in the command above). EC keys are not supported yet. Certificates expire after at most 2 years — set a reminder to rotate before then.
5

Upload the certificate and map it

Go to Setup → Integration → Manage Authentication → OAuth 2.0 Client Credentials Setup and click Create New:
  • Entity: the integration user from step 2
  • Role: the role from step 2
  • Application: the integration record from step 3
  • Certificate: upload netsuite-cert.pem
After saving, copy the Certificate ID from the list.
6

Configure in Abundly

Go to Settings → Capabilities, enable NetSuite, and create a new workspace secret of type NetSuite. Paste:
  • Account ID — shown under Setup → Company → Company Information (e.g. 1234567, or 1234567_SB1 for a sandbox)
  • Client ID (Consumer Key) — from step 3
  • Certificate ID — from step 5
  • Private key (PEM) — the contents of netsuite-key.pem, including the BEGIN/END lines
All four values live in a single workspace secret, so you only enter them once and can share the same secret across multiple agents.
Sandbox and production are fully separate in NetSuite — the integration record, certificate mapping, and role must be created in each account, and each gets its own workspace secret. See NetSuite’s OAuth 2.0 documentation for details.

​
Controlling what the agent can access

Access control lives in NetSuite, where it’s enforced on every request:
  • Scope the role tightly. The agent can only touch record types the mapped role has permissions for, at the access level you set (view/create/edit/full).
  • Use multiple secrets for different privilege levels. For example, map one certificate to a read-only role and another to a role that can create records, store them as two workspace secrets, and give each agent the one that matches its job.
  • Require approval for changes. Under the capability’s Require approval setting, choose Yes, for changes to let the agent read and report freely while every create, update, or delete waits for a person to approve it on the agent’s Activity page. The approval shows a plain summary, such as “Update vendorBill 4521: memo, dueDate”, along with the exact request. Newly enabled agents start with this setting, and workspace admins can lock it for everyone.
The role is the hard limit: a read-only role can never write, whatever the agent does. Approvals are the process control on top, for agents whose role is allowed to make changes.

​
Financial statements

Financial statements are available on request — contact us to enable them for your workspace.
The agent can produce an income statement, balance sheet, or trial balance for any accounting period or range, such as a month, a quarter, a fiscal year, or several months side by side. An income statement can also be compared with the previous period or the same period last year. To explain a number, the agent can pull the transaction detail behind any account: each posted line with its date, transaction, customer or vendor, and memo. Everything is built from the posted transactions in your general ledger (primary accounting book):
  • Consolidated by default. Amounts from the chosen subsidiary and all its child subsidiaries are translated with NetSuite’s consolidated exchange rates. The agent can also report on a single subsidiary without consolidating.
  • Filter by department, class, or location when you want a statement for one part of the business.
  • Retained earnings and net income are calculated the way NetSuite does it, since NetSuite doesn’t post closing entries.
The integration role needs permission to view transactions, accounts, accounting periods, and subsidiaries.
Financial statements are new and have not yet been verified against every NetSuite configuration, in particular multi-currency consolidation. Compare the first reports with the same report run in NetSuite before relying on them, and tell us about any difference.
The figures come from the ledger, not from NetSuite’s report engine, so custom report layouts and row groupings don’t carry over. If the numbers differ from a report you run in NetSuite, check that both use the same subsidiary, period range, and accounting book.

​
Saved searches and datasets

The agent can list and run the saved searches and SuiteAnalytics Workbook datasets your team has already built, so a question like “run the Open POs by Vendor search and summarize it” works without rebuilding the logic. It runs them as they are saved; it can’t change their filters. Running datasets requires the SuiteAnalytics Workbook permission on the integration role.

​
SuiteQL queries

For reporting and anything involving joins or aggregation, the agent uses SuiteQL (POST /services/rest/query/v1/suiteql) — an SQL-like query language over your NetSuite data. The agent gets up to 5,000 rows per query in one go and continues from there when you need more.
NetSuite limits each account to a number of concurrent API requests (15 by default, shared across all integrations). If other integrations are hitting the same account heavily, the agent may occasionally need to retry.