Connect NetSuite to Rig

    Rig queries NetSuite with SuiteQL and loads transactions, customers and items into your warehouse. Your NetSuite admin creates a Rig integration and maps a certificate to a read-only role, so Rig can read only what that role allows.

    Before you start

    • A NetSuite administrator does the setup, which takes about 15 minutes.
    • You need a machine with openssl to create a key pair, or a key pair your security team already holds.
    • Decide which transaction types should reach Rig. The default is the sales side.

    Step 1: Enable the features and create a key pair

    1. In NetSuite, go to Setup → Company → Enable Features → SuiteCloud and tick REST Web Services and OAuth 2.0.
    2. Create a certificate and private key: openssl req -x509 -newkey rsa:4096 -sha256 -days 730 -nodes -keyout rig_netsuite_key.pem -out rig_netsuite_cert.pem.

    Certificate lifetime
    The certificate above is valid for two years. Make a note to upload a new one and update Rig before it expires.

    Step 2: Create the Rig integration

    1. Go to Setup → Integration → Manage Integrations → New.
    2. Name it Rig, tick only Client Credentials (Machine to Machine) Grant and the REST Web Services scope, then save.
    3. Copy the Client ID. NetSuite shows it once.

    Step 3: Create a read-only role and map the certificate

    1. Create a role with the REST Web Services, Log in using OAuth 2.0 Access Tokens and SuiteAnalytics Workbook permissions, plus read access to only the records Rig may see. Without those three permissions, NetSuite can issue a token but refuses every query.
    2. Leave out records you do not want in your warehouse, such as employee or payroll data. This role is the hard boundary.
    3. Assign the role to the user Rig will act as.
    4. Go to Setup → Integration → Manage Authentication → OAuth 2.0 Client Credentials (M2M) Setup and create a new mapping. Choose that user, that role and the Rig integration, and upload rig_netsuite_cert.pem.
    5. Save, and copy the Certificate ID.

    Mappings are per account
    NetSuite does not copy this setup between production, sandbox and preview accounts. Repeat it in each account you connect.

    Step 4: Connect it in Rig

    Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

    1. In Rig, open Connections, choose the Connectors tab and go to Sources & actions.
    2. Search for NetSuite, open the card and click Connect.
    3. Account ID: your NetSuite account ID, such as 1234567, or 1234567_SB1 for a sandbox. You can find it under Setup → Company → Company Information.
    4. Client ID: the Client ID from the Rig integration record.
    5. Certificate ID: the Certificate ID from the M2M setup mapping.
    6. Private key (PEM): the whole contents of rig_netsuite_key.pem, including the BEGIN and END lines.
    7. Transaction types: leave as it is to read the sales side (SalesOrd,CustInvc,CustCred,CustPymt,CashSale). Add codes such as VendBill or Journal only if those should reach Rig.
    8. Transactions from: the earliest transaction date to read, as YYYY-MM-DD. It defaults to 2024-01-01.
    9. Click Continue. Rig checks the credentials and lists the streams it can reach, so choose the ones you want and click Connect.
    10. The source then syncs on its schedule, which is nightly unless you change it. To load data straight away, click Sync on its row; Test pulls a small sample first if you want to check the connection.

    What Rig pulls in

    NetSuite lands in its own netsuite schema in your warehouse:

    • Transactions: the transaction types you chose, from the date you set.
    • Customers: customer records.
    • Items: item records.

    Open the source's Edit picker to choose fields per stream. Contact details and free text start unticked.

    Good to know

    • Rig reads through SuiteQL and signs a short-lived token with your private key on each run, so the access token renews itself and nobody has to re-approve a consent screen. Only the certificate expires, so rotate it as noted above.
    • A role with fewer permissions returns fewer rows. If a table looks short, check the role before anything else.
    • Add vendor or journal transaction types only when you want them in the warehouse, since they widen what the role must be able to read.
    • To disconnect NetSuite, click the bin icon on the source's row under Sources & actions. Only whoever connected the source or a workspace owner can do this, and data already synced stays in the warehouse.

    What people use this for

    • Report on invoiced revenue
    • Understand customers and the item catalogue
    • Track sales orders through to invoiced revenue

    More ideas for using NetSuite

    Was this guide helpful?