> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Netsuite Contract Ingestion

*Lumos offers several NetSuite connectors, each its own integration card. This article covers **NetSuite Read-Only (with Invoice Ingestion)**: visibility only, plus importing SaaS invoices from NetSuite into the Vendors area of Lumos. For visibility without invoices use NetSuite Read-Only. To manage users (create, update, deactivate, delete) use NetSuite Provisioning. This is the same NetSuite integration connection as Provisioning, and the main difference is the permissions you grant your role.*

> For User Management, use one of **Netsuite Read-Only** or **Netsuite Provisioning**

## After this article

You will be able to connect NetSuite to Lumos to sync employees, roles, and permissions for visibility (without Lumos writing any changes back to NetSuite) and to import SaaS invoices from NetSuite into Lumos Vendors.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | No | User accounts (employee records) |
| Permissions | Permission | Yes | No | Permissions in NetSuite |
| Roles | Permission | Yes | No | Roles to manage access in NetSuite |
| Invoices | Vendor data | Yes | No | SaaS invoices imported into the Vendors area of Lumos |

| AppStore | Offboarding | Access Reviews | License Management |
| :- | :- | :- | :- |
| Yes | Yes | Yes | Yes |

Known limitations: login activity is limited to a 90-day lookback, limited information is available for vendor-type users, custom user fields may not be synced, and users with multiple roles may show the primary role only.

## Required plan and roles

* **NetSuite features:** enable SuiteTalk web services (REST and SOAP) and **Token-Based Authentication (TBA)** on the **Setup > Company > Enable Features** page, under the **SuiteCloud** tab. The integration authenticates with four credentials (Consumer Key, Consumer Secret, Token ID, and Token Secret) from an integration record in the **Enabled** state.
* **Lumos enablement:** invoice ingestion is not automatic. You need to work with your Lumos point of contact to enable invoice ingestion, and contact your Lumos CSM to enable daily syncs.
* **Token role permissions:** create a role for the integration and add these permissions under the **Permissions** subtab:
  * **Transactions > Bills: View**
  * **Transactions > Find Transactions: View**
  * **Reports > SuiteAnalytics Workbook: Edit**
  * **Lists > Vendors: View**
  * **Lists > Currency: View**
  * **Lists > Accounts: View**
  * **Lists > Employee Record: View**
  * **Lists > Employees: View**
  * **Setup > Login using Access Tokens: Full**
  * **Setup > REST Web Services: Full**
  * **Setup > User Access Tokens: Full**
  * **Setup > Bulk Manage Roles: View**
  * **Setup > SOAP Web Services: Full**
* **Login activity:** to sync login-activity data, the role also needs access to **Login Audit** records. Reading the vendor and transaction records above is what supports invoice ingestion.
* **Read-only:** this connector performs no write operations in NetSuite. To manage users and roles from Lumos, use NetSuite Provisioning instead.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode this connector supports. NetSuite Read-Only (with Invoice Ingestion) performs no write operations in NetSuite. Every capability row, including the added Invoices row, is sync-only.

**What read-only requires.** The four TBA credential values and your Account ID, generated against a role that holds the 13 read-only permissions listed in Required plan and roles above, including view access to Transactions, Vendors, and Employee records, plus the Setup permissions needed to authenticate. You'll also need to work with your Lumos point of contact to enable invoice ingestion and your Lumos CSM to enable daily syncs. Follow the steps below.

**Watch out for.** This card grants the same visibility as NetSuite Read-Only plus vendor and transaction records for invoices. It does not add any write capability. If you need Lumos to create, update, deactivate, or delete NetSuite users, connect the separate NetSuite Provisioning card instead.

## Instructions

**Phase 1: Prepare NetSuite**

1. Log into NetSuite with an Admin account. Save the subdomain from your account URL. For `https://1234567.app.netsuite.com/` the subdomain is `1234567`.
2. If you haven't already, enable SuiteTalk web services (REST and SOAP) and **Token-Based Authentication** on the **Setup > Company > Enable Features** page, under the **SuiteCloud** tab.
3. Create a role for the integration at **Setup > Users/Roles > Manage Roles > New**. Choose a name, select **All** under **Accessible Subsidiaries**, and add the 13 permissions listed above under the **Permissions** subtab. Click **Save**.
4. Attach the role to a user. Go to **Lists > Employees > Employees**, click **Edit** next to the user (existing or new), open the **Access > Roles** subtab, add the role, and click **Save**.
5. Create an integration record at **Setup > Integration > Manage Integrations > New**. Choose a name, uncheck **TBA: Authorization Flow** and **Authorization Code Grant**, and click **Save**. Copy the **Consumer Key** (Client ID) and **Consumer Secret** (Client Secret). You can't view them again after leaving the page. Confirm the record is in the **Enabled** state.
6. Create a token-based authentication token at **Setup > Users/Roles > Access Token > New**. Under **Application Name**, **User**, and **Role**, select the integration, the user, and the role you created. The **Token Name** auto-populates. Click **Save**, then copy the **Token ID** and **Token Secret**. NetSuite access tokens don't expire, but they can be manually revoked.

**Phase 2: Connect in Lumos**

1. Open the **NetSuite Read-Only (with Invoice Ingestion)** integration card in Lumos.
2. **Account ID:** the subdomain part of your NetSuite URL. For `https://1234567.app.netsuite.com/` the Account ID is `1234567`. For a sandbox it may look like `1234567-sb1`. Enter the full value and use a dash (`-`) as the separator, not an underscore.
3. Enter the Consumer Key, Consumer Secret, Token ID, and Token Secret, then click **Connect**.
4. Contact your Lumos CSM or point of contact to enable daily syncs for invoice ingestion.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Authentication failures ("Invalid login credentials" / "Token authentication failed"):** Verify Token-Based Authentication is enabled in NetSuite features. Confirm all four credentials are correct with no extra spaces. Check that the integration record is Enabled, the access token hasn't been deleted or revoked, the token's user account is still active, and the user's role has the necessary permissions.

**Users not syncing:** Verify the token's role has read permissions for Employee and Vendor records, users have email addresses, and users aren't inactive. This connector intentionally includes users with **Give Access** disabled, since they still have a NetSuite account worth tracking.

**Roles not appearing:** Verify read permissions for Role records and that roles are active and not restricted. A 400 **"Record role was not found"** error means the connecting role lacks the Bulk Manage Roles permission (or the wrong token is in use).

**Permissions not syncing:** Lumos queries the `rolepermissions` table, so only permission and level combinations currently assigned to at least one role will appear. Verify the missing permission level is assigned to at least one role, then trigger a new sync.

**Activity data not syncing:** Verify access to Login Audit records and that login audit logging is enabled. Only login events within the 90-day lookback are returned. If the LoginAudit record type isn't enabled or accessible for your account, the connector treats last activity as unavailable rather than failing.

**Invoices stopped appearing:** A spend-record sync failing with `InvalidCredentials: Invalid login attempt` usually means the connected NetSuite user's credentials changed or the user was modified. Confirm the failed login in **Setup > Users/Roles > User Management > View Login Audit Trail**, then reconnect the integration with valid credentials.

**"Invalid Account ID":** Recheck the Account ID against your NetSuite URL. If a full value with a suffix fails, try the numeric account ID alone. For sandboxes, verify you're using the correct sandbox account ID with a dash (not underscore) separator.

**API rate limit exceeded:** Reduce the concurrency limit, review other integrations consuming your API quota, or contact NetSuite to increase limits.