Skip to main content
Lumos offers several NetSuite connectors, each its own integration card. This article covers NetSuite Read-Only (with Invoice Ingestion): visibility only, plus importing SaaS invoices from NetSuite into the Vendors area of Lumos. For visibility without invoices use NetSuite Read-Only. To manage users (create, update, deactivate, delete) use NetSuite Provisioning. This is the same NetSuite integration connection as Provisioning, and the main difference is the permissions you grant your role.
For User Management, use one of Netsuite Read-Only or Netsuite Provisioning

​
After this article

You will be able to connect NetSuite to Lumos to sync employees, roles, and permissions for visibility (without Lumos writing any changes back to NetSuite) and to import SaaS invoices from NetSuite into Lumos Vendors.

​
Capabilities

Known limitations: login activity is limited to a 90-day lookback, limited information is available for vendor-type users, custom user fields may not be synced, and users with multiple roles may show the primary role only.

​
Required plan and roles

  • NetSuite features: enable SuiteTalk web services (REST and SOAP) and Token-Based Authentication (TBA) on the Setup > Company > Enable Features page, under the SuiteCloud tab. The integration authenticates with four credentials (Consumer Key, Consumer Secret, Token ID, and Token Secret) from an integration record in the Enabled state.
  • Lumos enablement: invoice ingestion is not automatic. You need to work with your Lumos point of contact to enable invoice ingestion, and contact your Lumos CSM to enable daily syncs.
  • Token role permissions: create a role for the integration and add these permissions under the Permissions subtab:
    • Transactions > Bills: View
    • Transactions > Find Transactions: View
    • Reports > SuiteAnalytics Workbook: Edit
    • Lists > Vendors: View
    • Lists > Currency: View
    • Lists > Accounts: View
    • Lists > Employee Record: View
    • Lists > Employees: View
    • Setup > Login using Access Tokens: Full
    • Setup > REST Web Services: Full
    • Setup > User Access Tokens: Full
    • Setup > Bulk Manage Roles: View
    • Setup > SOAP Web Services: Full
  • Login activity: to sync login-activity data, the role also needs access to Login Audit records. Reading the vendor and transaction records above is what supports invoice ingestion.
  • Read-only: this connector performs no write operations in NetSuite. To manage users and roles from Lumos, use NetSuite Provisioning instead.

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode this connector supports. NetSuite Read-Only (with Invoice Ingestion) performs no write operations in NetSuite. Every capability row, including the added Invoices row, is sync-only. What read-only requires. The four TBA credential values and your Account ID, generated against a role that holds the 13 read-only permissions listed in Required plan and roles above, including view access to Transactions, Vendors, and Employee records, plus the Setup permissions needed to authenticate. You’ll also need to work with your Lumos point of contact to enable invoice ingestion and your Lumos CSM to enable daily syncs. Follow the steps below. Watch out for. This card grants the same visibility as NetSuite Read-Only plus vendor and transaction records for invoices. It does not add any write capability. If you need Lumos to create, update, deactivate, or delete NetSuite users, connect the separate NetSuite Provisioning card instead.

​
Instructions

Phase 1: Prepare NetSuite
  1. Log into NetSuite with an Admin account. Save the subdomain from your account URL. For https://1234567.app.netsuite.com/ the subdomain is 1234567.
  2. If you haven’t already, enable SuiteTalk web services (REST and SOAP) and Token-Based Authentication on the Setup > Company > Enable Features page, under the SuiteCloud tab.
  3. Create a role for the integration at Setup > Users/Roles > Manage Roles > New. Choose a name, select All under Accessible Subsidiaries, and add the 13 permissions listed above under the Permissions subtab. Click Save.
  4. Attach the role to a user. Go to Lists > Employees > Employees, click Edit next to the user (existing or new), open the Access > Roles subtab, add the role, and click Save.
  5. Create an integration record at Setup > Integration > Manage Integrations > New. Choose a name, uncheck TBA: Authorization Flow and Authorization Code Grant, and click Save. Copy the Consumer Key (Client ID) and Consumer Secret (Client Secret). You can’t view them again after leaving the page. Confirm the record is in the Enabled state.
  6. Create a token-based authentication token at Setup > Users/Roles > Access Token > New. Under Application Name, User, and Role, select the integration, the user, and the role you created. The Token Name auto-populates. Click Save, then copy the Token ID and Token Secret. NetSuite access tokens don’t expire, but they can be manually revoked.
Phase 2: Connect in Lumos
  1. Open the NetSuite Read-Only (with Invoice Ingestion) integration card in Lumos.
  2. Account ID: the subdomain part of your NetSuite URL. For https://1234567.app.netsuite.com/ the Account ID is 1234567. For a sandbox it may look like 1234567-sb1. Enter the full value and use a dash (-) as the separator, not an underscore.
  3. Enter the Consumer Key, Consumer Secret, Token ID, and Token Secret, then click Connect.
  4. Contact your Lumos CSM or point of contact to enable daily syncs for invoice ingestion.

​
API Endpoints Used

​
Troubleshooting

Authentication failures (“Invalid login credentials” / “Token authentication failed”): Verify Token-Based Authentication is enabled in NetSuite features. Confirm all four credentials are correct with no extra spaces. Check that the integration record is Enabled, the access token hasn’t been deleted or revoked, the token’s user account is still active, and the user’s role has the necessary permissions. Users not syncing: Verify the token’s role has read permissions for Employee and Vendor records, users have email addresses, and users aren’t inactive. This connector intentionally includes users with Give Access disabled, since they still have a NetSuite account worth tracking. Roles not appearing: Verify read permissions for Role records and that roles are active and not restricted. A 400 “Record role was not found” error means the connecting role lacks the Bulk Manage Roles permission (or the wrong token is in use). Permissions not syncing: Lumos queries the rolepermissions table, so only permission and level combinations currently assigned to at least one role will appear. Verify the missing permission level is assigned to at least one role, then trigger a new sync. Activity data not syncing: Verify access to Login Audit records and that login audit logging is enabled. Only login events within the 90-day lookback are returned. If the LoginAudit record type isn’t enabled or accessible for your account, the connector treats last activity as unavailable rather than failing. Invoices stopped appearing: A spend-record sync failing with InvalidCredentials: Invalid login attempt usually means the connected NetSuite user’s credentials changed or the user was modified. Confirm the failed login in Setup > Users/Roles > User Management > View Login Audit Trail, then reconnect the integration with valid credentials. “Invalid Account ID”: Recheck the Account ID against your NetSuite URL. If a full value with a suffix fails, try the numeric account ID alone. For sandboxes, verify you’re using the correct sandbox account ID with a dash (not underscore) separator. API rate limit exceeded: Reduce the concurrency limit, review other integrations consuming your API quota, or contact NetSuite to increase limits.