Skip to main content
Connect your agent to NetSuite to read and update your ERP data — customers, vendors, invoices, sales orders, purchase orders, vendor bills, and any other record type. The agent can call any NetSuite REST API endpoint and run SuiteQL queries, so anything your integration role can do in NetSuite, the agent can do too.
NetSuite is currently enabled per workspace on request. Contact support@abundly.ai to turn it on for your workspace.

​
How to enable

Go to Settings → Capabilities and enable NetSuite, then link a workspace secret containing your NetSuite Account ID, Client ID, Certificate ID, and private key (setup below). The same secret can be reused across agents and teams.

​
Example use cases

  • Invoice monitoring — “Every morning, list invoices that became overdue yesterday and email me a summary per customer”
  • Vendor bill triage — “When you receive a supplier invoice by email, look up the vendor in NetSuite and check for an open purchase order that matches”
  • Reporting — “Run a SuiteQL query summing this month’s sales orders by subsidiary and post the result to the #finance Slack channel”
  • Data hygiene — “Find customers missing a payment-terms value and report them to me”

​
How to set up NetSuite authentication

NetSuite uses the OAuth 2.0 client credentials (machine-to-machine) flow with certificate authentication. The agent authenticates as a NetSuite integration mapped to a role you choose, so everything the agent does is limited to — and audited under — that role’s permissions.
1

Enable the required features

In NetSuite, go to Setup → Company → Enable Features → SuiteCloud and enable REST Web Services and OAuth 2.0.
2

Create a role for the agent

Create a dedicated role (Setup → Users/Roles → Manage Roles → New) with:
  • Log in using OAuth 2.0 Access Tokens (under Permissions → Setup)
  • REST Web Services (under Permissions → Setup)
  • The record permissions the agent needs (e.g. Customers, Invoices — view only, or full)
Assign the role to a user (a dedicated integration employee record is recommended).
Give the role only the record types and access levels the agent actually needs. NetSuite enforces these permissions on every request — a read-only role makes the agent read-only, guaranteed.
3

Create an integration record

Go to Setup → Integration → Manage Integrations → New:
  • Name: e.g. “Abundly Agent”
  • Under Authentication, check OAuth 2.0 with the Client Credentials (Machine to Machine) Grant, and check REST Web Services under scope
  • Uncheck the TBA/authorization-code options you don’t need
When you save, NetSuite shows the Consumer Key / Client ID once — copy it now.
4

Generate a certificate key pair

On your machine, generate an RSA key pair and a self-signed certificate (valid at most 2 years):
Keep netsuite-key.pem (the private key) safe — you’ll paste it into Abundly. netsuite-cert.pem is uploaded to NetSuite in the next step.
Use an RSA key (as in the command above). EC keys are not supported yet. Certificates expire after at most 2 years — set a reminder to rotate before then.
5

Upload the certificate and map it

Go to Setup → Integration → Manage Authentication → OAuth 2.0 Client Credentials Setup and click Create New:
  • Entity: the integration user from step 2
  • Role: the role from step 2
  • Application: the integration record from step 3
  • Certificate: upload netsuite-cert.pem
After saving, copy the Certificate ID from the list.
6

Configure in Abundly

Go to Settings → Capabilities, enable NetSuite, and create a new workspace secret of type NetSuite. Paste:
  • Account ID — shown under Setup → Company → Company Information (e.g. 1234567, or 1234567_SB1 for a sandbox)
  • Client ID (Consumer Key) — from step 3
  • Certificate ID — from step 5
  • Private key (PEM) — the contents of netsuite-key.pem, including the BEGIN/END lines
All four values live in a single workspace secret, so you only enter them once and can share the same secret across multiple agents.
Sandbox and production are fully separate in NetSuite — the integration record, certificate mapping, and role must be created in each account, and each gets its own workspace secret. See NetSuite’s OAuth 2.0 documentation for details.

​
Controlling what the agent can access

Access control lives in NetSuite, where it’s enforced on every request:
  • Scope the role tightly. The agent can only touch record types the mapped role has permissions for, at the access level you set (view/create/edit/full).
  • Use multiple secrets for different privilege levels. For example, map one certificate to a read-only role and another to a role that can create records, store them as two workspace secrets, and give each agent the one that matches its job.

​
SuiteQL queries

For reporting and anything involving joins or aggregation, the agent uses SuiteQL (POST /services/rest/query/v1/suiteql) — an SQL-like query language over your NetSuite data. Results paginate at 1,000 rows; the agent follows pagination automatically when you ask for more.
NetSuite limits each account to a number of concurrent API requests (15 by default, shared across all integrations). If other integrations are hitting the same account heavily, the agent may occasionally need to retry.