> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Netsuite Read-Only

*Lumos offers several NetSuite connectors, each its own integration card. This article covers **NetSuite Read-Only**, which provides visibility only and makes no changes in NetSuite. To also manage users (create, update, deactivate, delete) use NetSuite Provisioning. A separate read-only variant additionally imports SaaS invoices into Lumos Vendors.*

## After this article

You'll be able to connect NetSuite to Lumos and sync employees along with their roles and permissions. Lumos uses this data for visibility, Access Reviews, and offboarding tracking, without writing any changes back to NetSuite.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | No | User accounts (employee records) |
| Permissions | Permission | Yes | No | Permissions in NetSuite |
| Roles | Permission | Yes | No | Roles to manage access in NetSuite |

| AppStore | Offboarding | Access Reviews | License Management |
| :- | :- | :- | :- |
| Yes | Yes | Yes | Yes |

Known limitations: login activity is limited to a 90-day lookback. Limited information is available for vendor-type users. Custom user fields may not be synced, and users with multiple roles may show the primary role only.

## Required plan and roles

* **NetSuite features:** enable SuiteTalk web services (REST and SOAP) and Token-Based Authentication (TBA). Do this at **Setup > Company > Enable Features**, then the **SuiteCloud** tab. The integration authenticates with four credentials (Consumer Key, Consumer Secret, Token ID, and Token Secret) from an integration record in the **Enabled** state.
* **Read-only role permissions:** the role behind the access token needs these nine permissions:
  * **Setup > Login using Access Tokens: Full**
  * **Setup > REST Web Services: Full**
  * **Setup > User Access Tokens: Full**
  * **Setup > Bulk Manage Roles: View**
  * **Reports > SuiteAnalytics Workbook: Edit**
  * **Lists > Accounts: View**
  * **Lists > Employee Record: View**
  * **Lists > Employees: View**
  * **Setup > SOAP Web Services: Full**
* **Extra read scopes:** the role also reads **Vendor** and **Role** records, and it needs access to **Login Audit** records if you want login-activity data.
* **Read-only:** this connector performs no write operations in NetSuite. To manage users and roles from Lumos, use NetSuite Provisioning instead.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode this connector supports. NetSuite Read-Only performs no write operations in NetSuite. Every capability row on this connector is sync-only.

**What read-only requires.** The four TBA credential values (Consumer Key, Consumer Secret, Token ID, Token Secret) and your Account ID, generated against a role that holds the nine read-only permissions listed in Required plan and roles above, view-level access to Employee Record, Employees, Accounts, and Bulk Manage Roles, plus Full access to the Setup permissions needed to authenticate. Follow the steps below.

**Watch out for.** This is a separate integration card from NetSuite Provisioning, each with its own access token bound to a different NetSuite role. If you need Lumos to create, update, deactivate, or delete NetSuite users, connect the separate NetSuite Provisioning card instead. This read-only role's permissions won't support that.

## Instructions

**Phase 1: Prepare NetSuite**

1. Log into NetSuite with an Admin account. Save the subdomain from your NetSuite account URL. For `https://9999999.app.netsuite.com/` the subdomain is `9999999`. For a sandbox the subdomain might look like `9999999-sb1`. If it contains an underscore (`_`), replace it with a dash (`-`).
2. Enable SuiteTalk web services (REST and SOAP) and Token-Based Authentication at **Setup > Company > Enable Features**, then the **SuiteCloud** tab.
3. Create a read-only role at **Setup > Users/Roles > Manage Roles > New**. Name the role, select **All** under **Accessible Subsidiaries**, and add the nine permissions listed above under the **Permissions** subtab. Click **Save**.
4. Attach the role to a user. Go to **Lists > Employees > Employees**, click **Edit** on the chosen user (or create a new integration user), open the **Access > Roles** subtab, add the role you created, and click **Save**.
5. Create an integration record at **Setup > Integration > Manage Integrations > New**. Name it, uncheck **"TBA: Authorization Flow"** and **"Authorization Code Grant"**, and click **Save**. Copy the **Consumer Key** and **Consumer Secret**. You can't view these again after leaving the page.
6. Create a token-based authentication token at **Setup > Users/Roles > Access Token > New**. Under **Application Name**, **User**, and **Role**, select the integration from step 5, the user from step 4, and the read-only role from step 3. The **Token Name** populates automatically. Click **Save** and copy the **Token ID** and **Token Secret**. NetSuite access tokens don't expire, but you can revoke them manually, and you can't recover these values after leaving the page.

**Phase 2: Connect in Lumos**

1. Open the **NetSuite Read-Only** integration card in Lumos.
2. **Account ID:** the subdomain part of your NetSuite URL. For `https://1234567.app.netsuite.com/` the Account ID is `1234567`. For a sandbox it may look like `1234567-sb1`. Enter the full value and use a dash (`-`) as the separator, not an underscore.
3. Enter the Consumer Key, Consumer Secret, Token ID, and Token Secret.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Authentication failures ("Invalid login credentials" or "Token authentication failed").** Verify Token-Based Authentication is enabled in NetSuite features. Confirm all four credentials are correct with no extra spaces. Check that the integration record is Enabled, the access token hasn't been deleted or revoked, the token's user account is still active, and the user's role has the necessary permissions.

**Users not syncing.** Verify the token's role has read permissions for Employee and Vendor records, users have email addresses, and users aren't inactive. This connector intentionally includes users with **Give Access** disabled, since they still have a NetSuite account worth tracking.

**Roles not appearing.** Verify read permissions for Role records and that roles are active and not restricted. A 400 **"Record role was not found"** error means the connecting role lacks the Bulk Manage Roles permission (or the wrong token is in use).

**Permissions not syncing.** Lumos queries the `rolepermissions` table, so only permission and level combinations currently assigned to at least one role will appear. Verify the missing permission level is assigned to at least one role, then trigger a new sync.

**Activity data not syncing.** Verify access to Login Audit records and that login audit logging is enabled. Only login events within the 90-day lookback are returned. If the LoginAudit record type isn't enabled or accessible for your account, the connector treats last activity as unavailable rather than failing.

**"Invalid Account ID".** Recheck the Account ID against your NetSuite URL. If a full value with a suffix fails, try the numeric account ID alone. For sandboxes, verify you're using the correct sandbox account ID with a dash (not underscore) separator.

**API rate limit exceeded.** Reduce the concurrency limit, review other integrations consuming your API quota, or contact NetSuite to increase limits.