--- title: "Connect NetSuite to Rig — Rig guide" description: "Connect NetSuite to Rig with an OAuth 2.0 client credentials integration and a read-only role, and sync transactions, customers and items." canonical: "https://rig.so/guides/connect-netsuite" format: markdown --- Search guides, references, playbooks…⌘K Browse guides # Connect NetSuite to Rig Rig queries NetSuite with SuiteQL and loads transactions, customers and items into your warehouse. Your NetSuite admin creates a Rig integration and maps a certificate to a read-only role, so Rig can read only what that role allows. ## Before you start - A NetSuite administrator does the setup, which takes about 15 minutes. - You need a machine with `openssl` to create a key pair, or a key pair your security team already holds. - Decide which transaction types should reach Rig. The default is the sales side. ## Step 1: Enable the features and create a key pair 1. In NetSuite, go to `Setup` → `Company` → `Enable Features` → `SuiteCloud` and tick **REST Web Services** and **OAuth 2.0**. 2. Create a certificate and private key: `openssl req -x509 -newkey rsa:4096 -sha256 -days 730 -nodes -keyout rig_netsuite_key.pem -out rig_netsuite_cert.pem`. Certificate lifetime The certificate above is valid for two years. Make a note to upload a new one and update Rig before it expires. ## Step 2: Create the Rig integration 1. Go to `Setup` → `Integration` → `Manage Integrations` → `New`. 2. Name it Rig, tick only **Client Credentials (Machine to Machine) Grant** and the **REST Web Services** scope, then save. 3. Copy the **Client ID**. NetSuite shows it once. ## Step 3: Create a read-only role and map the certificate 1. Create a role with the **REST Web Services**, **Log in using OAuth 2.0 Access Tokens** and **SuiteAnalytics Workbook** permissions, plus read access to only the records Rig may see. Without those three permissions, NetSuite can issue a token but refuses every query. 2. Leave out records you do not want in your warehouse, such as employee or payroll data. This role is the hard boundary. 3. Assign the role to the user Rig will act as. 4. Go to `Setup` → `Integration` → `Manage Authentication` → `OAuth 2.0 Client Credentials (M2M) Setup` and create a new mapping. Choose that user, that role and the Rig integration, and upload `rig_netsuite_cert.pem`. 5. Save, and copy the **Certificate ID**. Mappings are per account NetSuite does not copy this setup between production, sandbox and preview accounts. Repeat it in each account you connect. ## Step 4: Connect it in Rig New to Rig? Watch how to find Connections Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source. 1. In Rig, open `Connections`, choose the `Connectors` tab and go to `Sources & actions`. 2. Search for **NetSuite**, open the card and click `Connect`. 3. **Account ID**: your NetSuite account ID, such as `1234567`, or `1234567_SB1` for a sandbox. You can find it under Setup → Company → Company Information. 4. **Client ID**: the Client ID from the Rig integration record. 5. **Certificate ID**: the Certificate ID from the M2M setup mapping. 6. **Private key (PEM)**: the whole contents of `rig_netsuite_key.pem`, including the BEGIN and END lines. 7. **Transaction types**: leave as it is to read the sales side (`SalesOrd,CustInvc,CustCred,CustPymt,CashSale`). Add codes such as `VendBill` or `Journal` only if those should reach Rig. 8. **Transactions from**: the earliest transaction date to read, as YYYY-MM-DD. It defaults to `2024-01-01`. 9. Click `Continue`. Rig checks the credentials and lists the streams it can reach, so choose the ones you want and click `Connect`. 10. The source then syncs on its schedule, which is nightly unless you change it. To load data straight away, click `Sync` on its row; `Test` pulls a small sample first if you want to check the connection. ## What Rig pulls in NetSuite lands in its own `netsuite` schema in your warehouse: - **Transactions**: the transaction types you chose, from the date you set. - **Customers**: customer records. - **Items**: item records. Open the source's `Edit` picker to choose fields per stream. Contact details and free text start unticked. ## Good to know - Rig reads through SuiteQL and signs a short-lived token with your private key on each run, so the access token renews itself and nobody has to re-approve a consent screen. Only the certificate expires, so rotate it as noted above. - A role with fewer permissions returns fewer rows. If a table looks short, check the role before anything else. - Add vendor or journal transaction types only when you want them in the warehouse, since they widen what the role must be able to read. - To disconnect NetSuite, click the bin icon on the source's row under `Sources & actions`. Only whoever connected the source or a workspace owner can do this, and data already synced stays in the warehouse. ## What people use this for - Report on invoiced revenue - Understand customers and the item catalogue - Track sales orders through to invoiced revenue [More ideas for using NetSuite](https://rig.so/integrations/netsuite) ## NetSuite documentation - [OAuth 2.0 client credentials setup](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html) Was this guide helpful? Yes No --- - [This page as HTML](https://rig.so/guides/connect-netsuite) - [Site map for language models](https://rig.so/llms.txt) - [API and agent documentation](https://rig.so/developers)