Set up your NetSuite connection

• SuiteTalk (Web Services): REST Web Services
• Manage Authentication: OAuth 2.0
• Analytics: SuiteAnalytics Workbook
• Invoice access: Client SuiteScript and Server SuiteScript

Save. NetSuite may first ask you to accept the SuiteCloud Terms of Service.

1. Name the integration CO2 Lab and leave its state enabled.
2. Enable the Client Credentials (Machine to Machine) grant.
3. Enable the REST Web Services scope.
4. Enable the RESTlets scope.
5. Save and copy the 64-character Client ID. Do not include the field label's trailing ID.

CO2 Lab does not use the Consumer Secret shown on the confirmation page.

1. Name the role CO2 Lab Integration.
2. Leave Web Services Only disabled, because enabling it blocks the RESTlet.
3. Add the core ledger permissions:

   Core permissions for the CO2 Lab integration role

   Subtab	Permission and level	Reason
   Setup	Log in using OAuth 2.0 Access Tokens (Full)	Authenticate the mapped integration identity
   Setup	REST Web Services (Full)	Query SuiteTalk REST
   Setup	Manage Accounting Periods (View)	Read period close status
   Reports	SuiteAnalytics Workbook (Edit)	Execute SuiteQL
   Lists	Accounts (View)	Read account codes, names and types
   Lists	Vendors (View)	Read vendor identity and permitted vendor metadata
   Lists	Subsidiaries (View)	Read the OneWorld structure and line subsidiary
   Lists	Currency (View)	Read currencies used by the account
   Lists	Items (View)	Read item and physical-quantity attributes where available
   Lists	Locations (View)	Read the location assigned to a line
   Lists	Departments (View)	Read the department assigned to a line
   Lists	Classes (View)	Read the class assigned to a line
   Transactions	Bills (View)	Read vendor bills
   Transactions	Enter Vendor Credits (View)	Read vendor credits

   SuiteAnalytics Workbook requires Edit to run SuiteQL. It does not permit transaction changes.

4. Add the document-access permissions, which let CO2 Lab read the invoice files behind your bills:

   Document-access permissions for the CO2 Lab integration role

   Subtab	Permission and level	Reason
   Setup	SuiteScript (View)	Run the read-only attachment RESTlet
   Lists	Documents and Files (View)	Read permitted File Cabinet files
   Lists	Messages (View)	Find files attached through transaction messages
   Lists	Perform Search (View)	Search transaction-to-file links
   Transactions	Find Transaction (View)	Find the source transaction for a file

5. On OneWorld, set the role's Subsidiary Restrictions to Selected and add each in-scope subsidiary.

Two of these permissions grant less than their names suggest:

Add the role to the employee who will own the certificate mapping. You can use an existing licensed user. A dedicated user may require another licence.

Select Create New.

1. For Entity, select the user from step 4.
2. For Role, select the CO2 Lab Integration role.
3. For Application, select the CO2 Lab integration record.
4. For Certificate, upload the public certificate supplied by CO2 Lab.
5. Save, then copy the Certificate ID.

Do not send CO2 Lab a private key or NetSuite password.

CO2 Lab reads each invoice PDF through the read-only RESTlet from step 2. It only searches and loads files. It never creates, edits or deletes anything, and it runs under the same read-only role.

1. Upload netsuite-file-fetch.js (supplied by CO2 Lab) to the File Cabinet, usually the SuiteScripts folder. Keep the .js file name.
2. Create the script record. In the ID field, type _co2lab_filefetch. NetSuite adds the customscript prefix on save, giving customscript_co2lab_filefetch.
3. Add a deployment the same way for customdeploy_co2lab_filefetch, with status Released and the CO2 Lab Integration role in its audience.

The fixed IDs mean there is nothing extra to send CO2 Lab. Full source is available for review, and a signed SDF bundle on request.

Send CO2 Lab these values:

Account ID

Setup → Company → Company Information

Client ID

Created with the integration record in step 2

Certificate ID

Created with the certificate mapping in step 5

On a sandbox, the Account ID uses an uppercase suffix with an underscore, for example 1234567_SB1. If Company Information shows the hyphen form 1234567-sb1, convert it to the underscore form.

These identifiers cannot grant access without the private key and active mapping.

CO2 Lab runs four checks before the connection is accepted:

1. NetSuite issues an OAuth 2.0 access token.
2. The role can read the chart of accounts and configured subsidiaries.
3. A bounded reporting period returns posted ledger lines.
4. The imported total is compared with the equivalent NetSuite report.

Enlarge