NetSuite Access for Data Foundation

Data Foundation reads NetSuite with OAuth 2.0 machine-to-machine access: a read-only role, an integration record that uses the client credentials grant, and a certificate. This page is for the NetSuite administrator who sets that up, and for the PlaidCloud user who asks them to.

PlaidCloud only reads data. Nobody sends a password, a token secret or a private key by email.

Before You Start: Create the Certificate

The PlaidCloud user’s team creates an RSA key pair and keeps the private key. Only the public certificate goes to NetSuite. For example, with OpenSSL:

openssl req -new -x509 -newkey rsa:3072 -nodes -days 730 \
    -keyout plaidcloud_netsuite.pem \
    -out plaidcloud_netsuite_public.pem \
    -subj "/CN=PlaidCloud"

Attach plaidcloud_netsuite_public.pem to the request you send the administrator. Keep plaidcloud_netsuite.pem for the Private key field in PlaidCloud.

Send the Access Request

On the project’s Foundation tab, choose Create a new connection under NetSuite connection. The form shows the full request. Click Copy request to paste it into your own message, or Email request to open it in your mail program with the subject “NetSuite access for PlaidCloud.” Attach the public certificate.

What the NetSuite Administrator Sets Up

Enable features. Under Setup > Company > Enable Features > SuiteCloud, enable:
- REST Web Services
- OAuth 2.0
- SuiteAnalytics Workbook (needed for SuiteQL)

Create a read-only role, for example “PlaidCloud Read Only”, with these permissions:

Permission	Level
Setup: REST Web Services	Full
Setup: Log in using OAuth 2.0 Access Tokens	Full
Transactions: Invoice, Cash Sale and Credit Memo	View
Lists: Items and Locations	View
Transactions: Budget	View
Reports: General Ledger	View
Setup: Accounting Periods	View
Lists: Subsidiaries	View

Give the role access to every subsidiary PlaidCloud reports on.

Create an integration record. Under Setup > Integration > Manage Integrations > New:
- Name: PlaidCloud
- Authentication: tick Client Credentials (Machine to Machine) Grant only — no token-based authentication and no authorization code grant.
- Scopes: REST Web Services and RESTlets.
Save it and copy the Client ID. NetSuite shows it once, on the confirmation page.
Map the certificate. Under Setup > Integration > OAuth 2.0 Client Credentials (M2M) Setup > Create New:
- Entity: the user PlaidCloud acts as.
- Role: the role from step 2.
- Application: PlaidCloud, the integration from step 3.
- Certificate: the public certificate attached to the request.
Save it and copy the Certificate ID.

What to Send Back

The administrator sends	Entered in PlaidCloud as
The Account ID, from Setup > Company > Company Information — for example `1234567`, or `1234567_SB1` for a sandbox	Account ID
The Client ID from step 3	Client ID
The Certificate ID from step 4	Certificate ID
The subsidiaries PlaidCloud may read	Chosen under Subsidiaries in PlaidCloud

The private key that matches the certificate stays with the PlaidCloud user’s team. They paste it into PlaidCloud themselves as the Private key.

Check the Access

Back in PlaidCloud, enter the values and click Test connection. Each dataset shows as Readable, Missing permission or Error:

Dataset	Permission it needs
Sales lines	Transactions: Invoice, Cash Sale and Credit Memo (View)
Inventory balances	Lists: Items and Locations (View)
Budgets	Transactions: Budget (View)
Statistical accounts	Reports: General Ledger (View)
Accounting periods	Setup: Accounting Periods (View)
Subsidiaries	Lists: Subsidiaries (View)

When a dataset is missing, the test names the permissions to add. Ask the administrator to add them to the role and test again. Budgets are optional: a NetSuite account that doesn’t use budgets still loads everything else.