Skip to main content
Lumos offers several NetSuite connectors, each its own integration card. This article covers NetSuite Read-Only, which provides visibility only and makes no changes in NetSuite. To also manage users (create, update, deactivate, delete) use NetSuite Provisioning. A separate read-only variant additionally imports SaaS invoices into Lumos Vendors.

​
After this article

You’ll be able to connect NetSuite to Lumos and sync employees along with their roles and permissions. Lumos uses this data for visibility, Access Reviews, and offboarding tracking, without writing any changes back to NetSuite.

​
Capabilities

Known limitations: login activity is limited to a 90-day lookback. Limited information is available for vendor-type users. Custom user fields may not be synced, and users with multiple roles may show the primary role only.

​
Required plan and roles

  • NetSuite features: enable SuiteTalk web services (REST and SOAP) and Token-Based Authentication (TBA). Do this at Setup > Company > Enable Features, then the SuiteCloud tab. The integration authenticates with four credentials (Consumer Key, Consumer Secret, Token ID, and Token Secret) from an integration record in the Enabled state.
  • Read-only role permissions: the role behind the access token needs these nine permissions:
    • Setup > Login using Access Tokens: Full
    • Setup > REST Web Services: Full
    • Setup > User Access Tokens: Full
    • Setup > Bulk Manage Roles: View
    • Reports > SuiteAnalytics Workbook: Edit
    • Lists > Accounts: View
    • Lists > Employee Record: View
    • Lists > Employees: View
    • Setup > SOAP Web Services: Full
  • Extra read scopes: the role also reads Vendor and Role records, and it needs access to Login Audit records if you want login-activity data.
  • Read-only: this connector performs no write operations in NetSuite. To manage users and roles from Lumos, use NetSuite Provisioning instead.

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode this connector supports. NetSuite Read-Only performs no write operations in NetSuite. Every capability row on this connector is sync-only. What read-only requires. The four TBA credential values (Consumer Key, Consumer Secret, Token ID, Token Secret) and your Account ID, generated against a role that holds the nine read-only permissions listed in Required plan and roles above, view-level access to Employee Record, Employees, Accounts, and Bulk Manage Roles, plus Full access to the Setup permissions needed to authenticate. Follow the steps below. Watch out for. This is a separate integration card from NetSuite Provisioning, each with its own access token bound to a different NetSuite role. If you need Lumos to create, update, deactivate, or delete NetSuite users, connect the separate NetSuite Provisioning card instead. This read-only role’s permissions won’t support that.

​
Instructions

Phase 1: Prepare NetSuite
  1. Log into NetSuite with an Admin account. Save the subdomain from your NetSuite account URL. For https://9999999.app.netsuite.com/ the subdomain is 9999999. For a sandbox the subdomain might look like 9999999-sb1. If it contains an underscore (_), replace it with a dash (-).
  2. Enable SuiteTalk web services (REST and SOAP) and Token-Based Authentication at Setup > Company > Enable Features, then the SuiteCloud tab.
  3. Create a read-only role at Setup > Users/Roles > Manage Roles > New. Name the role, select All under Accessible Subsidiaries, and add the nine permissions listed above under the Permissions subtab. Click Save.
  4. Attach the role to a user. Go to Lists > Employees > Employees, click Edit on the chosen user (or create a new integration user), open the Access > Roles subtab, add the role you created, and click Save.
  5. Create an integration record at Setup > Integration > Manage Integrations > New. Name it, uncheck “TBA: Authorization Flow” and “Authorization Code Grant”, and click Save. Copy the Consumer Key and Consumer Secret. You can’t view these again after leaving the page.
  6. Create a token-based authentication token at Setup > Users/Roles > Access Token > New. Under Application Name, User, and Role, select the integration from step 5, the user from step 4, and the read-only role from step 3. The Token Name populates automatically. Click Save and copy the Token ID and Token Secret. NetSuite access tokens don’t expire, but you can revoke them manually, and you can’t recover these values after leaving the page.
Phase 2: Connect in Lumos
  1. Open the NetSuite Read-Only integration card in Lumos.
  2. Account ID: the subdomain part of your NetSuite URL. For https://1234567.app.netsuite.com/ the Account ID is 1234567. For a sandbox it may look like 1234567-sb1. Enter the full value and use a dash (-) as the separator, not an underscore.
  3. Enter the Consumer Key, Consumer Secret, Token ID, and Token Secret.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Authentication failures (“Invalid login credentials” or “Token authentication failed”). Verify Token-Based Authentication is enabled in NetSuite features. Confirm all four credentials are correct with no extra spaces. Check that the integration record is Enabled, the access token hasn’t been deleted or revoked, the token’s user account is still active, and the user’s role has the necessary permissions. Users not syncing. Verify the token’s role has read permissions for Employee and Vendor records, users have email addresses, and users aren’t inactive. This connector intentionally includes users with Give Access disabled, since they still have a NetSuite account worth tracking. Roles not appearing. Verify read permissions for Role records and that roles are active and not restricted. A 400 “Record role was not found” error means the connecting role lacks the Bulk Manage Roles permission (or the wrong token is in use). Permissions not syncing. Lumos queries the rolepermissions table, so only permission and level combinations currently assigned to at least one role will appear. Verify the missing permission level is assigned to at least one role, then trigger a new sync. Activity data not syncing. Verify access to Login Audit records and that login audit logging is enabled. Only login events within the 90-day lookback are returned. If the LoginAudit record type isn’t enabled or accessible for your account, the connector treats last activity as unavailable rather than failing. “Invalid Account ID”. Recheck the Account ID against your NetSuite URL. If a full value with a suffix fails, try the numeric account ID alone. For sandboxes, verify you’re using the correct sandbox account ID with a dash (not underscore) separator. API rate limit exceeded. Reduce the concurrency limit, review other integrations consuming your API quota, or contact NetSuite to increase limits.