NetSuite

netsuite is a cloud erp that manages finance, inventory, and orders for most enterprise brands chord ingests netsuite's general ledger, transaction, and item master data so you can model per order cogs, landed costs, inventory movements, and revenue attribution alongside the rest of your stack chord reads exclusively via suiteql, an sql interface to netsuite's data, using token based authentication (oauth 1 0a) what chord ingests from netsuite chord pulls 21 datasets from your netsuite account each dataset becomes its own table in your chord snowflake schema account chart of accounts account number, name, type, balance, and hierarchy account type account classification lookup (e g income, expense, bank, fixed asset) accounting period fiscal calendar period name, start/end date, closed flag per accounting book classification classification segment lookup (aka segments or classes in older netsuite configs) customer customer records name, identifier, email, billing/shipping address, tax id, stage department department segment lookup employee employee records (full sync per run, useful for payroll joins) entity unified bridge spanning customer, vendor, and employee records name, type, primary address item item catalog sku, description, item type, cost, pricing, costing method, custom fields subsidiary legal entity / subsidiary lookup (critical for oneworld accounts) transaction status transaction status lookup, scoped per transaction type (e g pending, billed, closed) vendor vendor records name, identifier, email, address, tax id, payment terms aggregate item location on hand and available quantity per item and location aggregates multiple quantity types (committed, on order, backordered) use this for inventory snapshot reporting inventory item locations per location quantity detail on hand, committed, backordered, on order use this for supply chain planning assembly item locations per location quantity detail for assembly (parent) items item location availability available quantity per item and location transaction transaction header spanning all types sales orders, invoices, cash sales, credit memos, vendor bills, purchase orders, item fulfillments, payment applications, and inventory adjustments merged incrementally on last modified date includes custom fields transaction line transaction line detail quantity, rate, amount, gl account mappings, custom fields one row per line per transaction merged incrementally (cursor is the parent transaction's last modified date) transaction accounting line general ledger posting detail per transaction line and accounting book account, debit/credit amounts, posting date this is the source for realized cogs and revenue attribution merged incrementally transaction shipping address shipping address snapshot per transaction merged incrementally transaction billing address billing address snapshot per transaction merged incrementally generate a netsuite api credential set you'll need five values from your netsuite account account id, consumer key, consumer secret, token id, and token secret all five must be copied from netsuite together at the time of creation or rotation chord uses them to sign oauth 1 0a requests to the suiteql endpoint token based authentication (tba) is the only supported flow oauth 2 0 is not available heads up only netsuite account administrators or users with the "setup" permission for integration and access tokens can create these credentials if your role doesn't include it, ask a netsuite admin to either generate the credential set for you or grant your user the required permissions first 1\ enable required features in netsuite log in to netsuite as an administrator go to setup → company → enable features click the suitecloud tab in the suitescript section, check client and server (if not already enabled) in the manage authentication section, check token based authentication (if not already enabled) in the suitetalk (web services) section, check rest web services (if not already enabled) click save 2\ create an integration record to get consumer key and consumer secret go to setup → integration → manage integrations → new fill in name something like chord data sync check token based authentication (if not already checked) uncheck authorization code grant credential flow (chord signs requests directly and does not use callbacks) click save on the confirmation page, you'll see consumer key and consumer secret copy both values immediately they are shown only once 3\ create an access token to get token id and token secret go to setup → users/roles → access tokens → new select the integration pick the integration record you just created (e g chord data sync ) select the user the integration user who will own this token (e g a dedicated service account) select the role the integration role you'll grant with the permissions below click save on the confirmation page, you'll see token id and token secret copy both values immediately they are shown only once and cannot be revealed later 4\ grant required permissions to the integration role go to setup → users/roles → manage roles and click the integration role you selected above click the permissions subtab grant the following setup permissions log in using access tokens → full rest web services → full grant the following reports permission suiteanalytics workbook → edit this permission is critical for suiteql queries rest web services alone is not sufficient grant the following lists permissions (view level) customers → view items → view vendors → view subsidiaries → view accounts → view departments → view classes → view locations → view accounting periods → view inventory → view grant the following transactions permissions (view level) sales orders → view invoices → view cash sales → view credit memos → view customer payments → view item fulfillments → view vendor bills → view purchase orders → view item receipts → view adjust inventory → view click save 5\ for oneworld accounts, ensure all subsidiary access if your netsuite account uses multiple subsidiaries (oneworld) go to setup → users/roles → manage roles and click the integration role under the subsidiary restrictions setting, choose all (or selected with all target subsidiaries checked) if left at the default user subsidiary , chord will silently ingest only the integration user's assigned subsidiary and miss all others go to setup → users/roles → manage users , click the integration user, and confirm under subsidiary restrictions that they also have access to all target subsidiaries click save connect the credential set in chord open chord hub and go to data sources → add source pick netsuite from the data source list enter your account id in the account id field format production = 1234567 , sandbox = 1234567 sb1 (underscore before the sb suffix, not hyphen) paste the consumer key you copied into the consumer key field paste the consumer secret you copied into the consumer secret field paste the token id you copied into the token id field paste the token secret you copied into the token secret field click save chord will make a test suiteql query against your netsuite account to confirm all five values are correct and the integration role has the required permissions this validation happens immediately on save if validation passes, the first sync kicks off automatically subsequent syncs run on your tenant's standard ingestion schedule if validation fails, you'll see an error message with details on what's missing or misconfigured (see troubleshooting below) troubleshooting the credential validation failed with a 400 error what does the error detail text say? netsuite returns http 400 with status invalid parameter for both authentication failures and permission problems the error message body contains a detail field that tells you which one look for one of these two messages "suiteanalytics workbook feature has been disabled" → the feature is turned off account wide fix go to setup → company → enable features , click the suitecloud tab, and check analytics in the suiteanalytics section save and retry the chord validation "your current role does not have permission to perform this action" → the feature is on, but the integration role is missing the suiteanalytics workbook permission fix go to setup → users/roles → manage roles , click the integration role, click permissions , find reports , and grant suiteanalytics workbook → edit save and retry the chord validation these two failures look identical from the http status code alone, but the detail text tells you which one you're facing and where to fix it the validation failed with invalid login , but my credentials look right to me what's the most likely cause? the most common cause (especially if this credential was working before) is that you rotated your access token or consumer credentials but didn't update all five fields in chord at the same time netsuite returns invalid login whenever the signature doesn't match, whether the cause is a typo, a revoked token, or (most commonly) a partial update the error text itself won't tell you which, so check for a partial update first when you regenerate a token in netsuite, you get new token id and token secret values when you regenerate consumer credentials, you get new consumer key and consumer secret values if you paste only some of the new values into chord while others remain stale, the oauth signature will fail the signature requires all five pieces to match exactly as they stand together in netsuite at that moment updating four fields and leaving one stale breaks the connection always copy all five values fresh from netsuite (account id, consumer key, consumer secret, token id, token secret) and paste them all into chord at once, then save chord validates all five together immediately on save i copied the values but validation still fails should i check for hidden whitespace? yes consumer key, consumer secret, token id, and token secret are long strings that are easy to copy with leading or trailing whitespace, which breaks the signature paste each field into chord, then manually check that there are no spaces at the very start or end of the value netsuite's credential display pages sometimes add whitespace when you select the text clear it before pasting if you're still stuck, generate fresh credentials in netsuite and retry you may have copied partially or with an invisible character do netsuite tba tokens expire? no access tokens remain valid indefinitely unless you explicitly revoke or regenerate them in netsuite if a working credential suddenly fails, check that the token has not been revoked under setup → users/roles → access tokens also check that the integration user and role have not been disabled tba tokens do not time out, but they break if the user account or the role is deactivated how do i rotate the credential set? in netsuite, regenerate the access token go to setup → users/roles → access tokens , click the token, and click regenerate token this produces a new token id and token secret at the same time, go to setup → integration → manage integrations , click your integration record, and regenerate the consumer key and consumer secret click regenerate credentials copy all five values account id (unchanged), plus the new consumer key, consumer secret, token id, and token secret in chord, open the same netsuite credential entry, paste all five values (replacing what's there), and click save chord validates the new set immediately on save once validation passes and the next sync runs cleanly, you can delete the old token and integration record in netsuite i'm only seeing data from one subsidiary but we have multiple what's happening? this is a oneworld scope issue by default, the integration role's subsidiary restrictions are set to user subsidiary , which silently filters all suiteql responses to only that subsidiary netsuite returns no error for out of scope rows it just excludes them check the role and integration user's subsidiary restrictions (as described in step 5 of the credential setup above) and set them to all to access every subsidiary then kick off a new chord sync need help? if you hit a credential, permission, or connectivity issue you can't resolve, reach out to help\@chord co mailto\ help\@chord co with the exact error message (or screenshot) we'll trace the request against your netsuite account and tell you what's missing or misconfigured