> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# NetSuite

> Learn how to connect your NetSuite instance with Opal to manage and review access.

Opal natively supports an integration with NetSuite. This integration enables organizations to manage access to NetSuite roles.

> [!NOTE]
>
> Opal cannot modify Administrator roles due to NetSuite API limitations.

## Supported resources and functionality

| Resource | Read | Grant and revoke access | Available in Risk Center |
| - | - | - | - |
| NetSuite Roles | ✔️ | ✔️ | ✔️ |

Opal syncs all active NetSuite roles and employees who have login access enabled (`Give Access = true`).

> [!NOTE]
>
> NetSuite requires an employee to have a role when the employee is created, or when login access is enabled for an employee who has no roles. In these cases, Opal first assigns the least-privileged `Employee Center` role, then adds the role that was requested. Make sure a role named exactly `Employee Center` exists in your NetSuite account.

## Getting Started

In Opal, go to the **Inventory**, select the **+App** icon, and select **NetSuite**.

## 1. Generate a key pair

The NetSuite integration uses OAuth 2.0 Client Credentials (machine-to-machine) with a certificate-based JWT. You need to generate a key pair and register the public certificate in NetSuite.

Run the following commands to generate an EC key pair (ES256):

```bash theme={null}
openssl ecparam -name prime256v1 -genkey -noout -out private_key.pem
openssl req -new -x509 -key private_key.pem -out certificate.pem -days 730 -subj "/CN=OpalIntegration"
```

Keep `private_key.pem` — you will upload it to Opal. You will upload `certificate.pem` to NetSuite in the next step.

## 2. Enable required NetSuite features

1. In NetSuite, go to **Setup > Company > Enable Features**.
2. Click the **SuiteCloud** tab.
3. Under **SuiteTalk**, check **REST Web Services**.

![NetSuite SuiteCloud tab with REST Web Services checked under SuiteTalk](https://mintcdn.com/opalsecurity/Ln4UeebFd5qjQWNz/images/docs/netsuite-suitecloud-rest-web-services.png?fit=max\&auto=format\&n=Ln4UeebFd5qjQWNz\&q=85\&s=2be47ce0726c6e9e4f31af3a45538531)

4. Under **Manage Authentication**, check **OAuth 2.0**.

![NetSuite SuiteCloud tab with OAuth 2.0 checked under Manage Authentication](https://mintcdn.com/opalsecurity/Ln4UeebFd5qjQWNz/images/docs/netsuite-suitecloud-oauth2.png?fit=max\&auto=format\&n=Ln4UeebFd5qjQWNz\&q=85\&s=454e16b7df7f5ca6c580a082094eb9b7)

5. Save.

## 3. Create a NetSuite integration record

1. In NetSuite, go to **Setup > Integration > Manage Integrations > New**.
2. Fill in the following settings:

| Setting | Value |
| - | - |
| Name | `Opal` |
| State | Enabled |
| Client Credentials (Machine to Machine) Grant | Checked |
| Token-Based Authentication | Unchecked |
| Authorization Code Grant | Unchecked |
| REST Web Services (scope) | Checked |

![NetSuite integration record showing REST Web Services scope checked under OAuth 2.0](https://mintcdn.com/opalsecurity/Ln4UeebFd5qjQWNz/images/docs/netsuite-integration-rest-scope.png?fit=max\&auto=format\&n=Ln4UeebFd5qjQWNz\&q=85\&s=8d75623dd2af83e9522cd2ae2c44a55a)

3. Save the record. Copy the **Client ID** — you will need it later.

## 4. Upload the certificate

1. Still in NetSuite, go to **Setup > Integration > OAuth 2.0 Client Credentials (M2M) Setup**.
2. Set **Entity** to the service account user or role that Opal will authenticate as.
3. Upload the `certificate.pem` file you generated in step 1.
4. Save the record. Copy the **Certificate ID** — you will need it later.

> [!NOTE]
>
> Every time you regenerate the certificate, NetSuite requires a new mapping row in this setup. Ensure the new row is bound to the correct user and the **Opal Integration** role.

## 5. Create the Opal Integration role

Create a dedicated NetSuite role with the minimum permissions required by Opal.

1. Go to **Setup > Users/Roles > Manage Roles > New**.
2. Set the **Name** to `Opal Integration`.
3. Under the **Permissions** tab, add the following permissions and save the role:

**Setup**

| Permission | Level |
| - | - |
| Access Token Management | Full |
| Bulk Manage Roles | Full |
| Log in using Access Tokens | Full |
| Log in using OAuth 2.0 Access Tokens | Full |
| REST Web Services | Full |
| Records Catalog | View |
| User Access Tokens | Full |

**Lists**

| Permission | Level |
| - | - |
| Employee Record | View (read-only sync) or Edit (required for user provisioning) |
| Employees | View (read-only sync) or Edit (required for user provisioning) |

**Reports**

| Permission | Level |
| - | - |
| SuiteAnalytics Workbook | Edit |

## 6. Assign the role to the integration certificate

1. Go to **Setup > Users/Roles > Manage Roles** and open the **Opal Integration** role.
2. Under the **Users** subtab, add the employee or service account that owns the certificate created in step 4.

Alternatively, assign the role directly on the employee record: **Lists > Employees**, open the employee, go to the **Access** subtab, and add the **Opal Integration** role.

## 7. Connect NetSuite in Opal

Back in the Opal New App form, fill in the following fields:

| Field | Value |
| - | - |
| Account ID | Your NetSuite account ID (e.g. `1234567` or `1234567_SB1` for sandbox) |
| Client ID | The Client ID from the integration record created in step 3 |
| Certificate ID | The Certificate ID from step 4 |
| Private Key | Upload the `private_key.pem` file generated in step 1 |

Click **Connect**. Opal will validate the credentials and verify the **Opal Integration** role has the required permissions. Any missing permissions appear in the **App Validations** section of the app's **Setup** tab.

## User provisioning

> [!NOTE]
>
> User provisioning requires the **Opal Integration** role to have **Edit**
> access on **Employee Record** and **Employees**, in addition to the
> permissions listed in [step 5](#5-create-the-opal-integration-role).

Opal can automatically provision users in NetSuite. Opal does not deprovision NetSuite users.

When provisioning is enabled, users who don't already have NetSuite access are provisioned when they are granted access to a NetSuite role. If no employee with the user's email exists, Opal creates one with login access enabled and the **Employee Center** role. If the employee exists without login access, Opal enables login access and keeps their existing roles, or assigns **Employee Center** if they have none.

This is configurable in **Setup > Edit > Provision NetSuite users**. For more details, see [User provisioning](https://docs.opal.dev/docs/user-provisioning.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.