Connect NetSuite

Use a NetSuite connection when AI needs controlled access to ERP records or a customer-owned NetSuite workflow. Type supports OAuth 2.0 authorization code connections for both SuiteTalk REST web services and RESTlets.

Choose the API target before connecting:

• Use SuiteTalk REST for standard record operations, metadata, SuiteQL queries, record actions, and transformations.
• Use a RESTlet when your organization already has a deployed RESTlet or needs custom validation, multi-record orchestration, or a narrow API contract.

Oracle’s comparison of NetSuite integration options explains the platform differences. The OAuth setup is the same for both options, but each Type connection uses one API base URL. If a Space needs both, create two NetSuite connections and name them clearly.

Before you start

You need:

• A NetSuite administrator who can enable features and create an integration record.
• A NetSuite user and role for each person or service account that will connect.
• Permission to manage connections for the Type Space.
• The Type OAuth redirect URL shown in the NetSuite connection form.
• Your NetSuite account ID.
• For a RESTlet, its deployed script ID, deployment ID, supported HTTP methods, and request format.

Use a NetSuite sandbox for initial setup and write testing whenever possible.

Configure NetSuite features

A NetSuite administrator should confirm the required features are enabled:

1. In NetSuite, go to Setup → Company → Enable Features.
2. On the SuiteCloud subtab, enable OAuth 2.0.
3. For SuiteTalk, enable REST Web Services.
4. For a RESTlet, confirm the RESTlet script and deployment are released and available to the intended roles.

Oracle documents the REST web services prerequisites and OAuth 2.0 setup.

Create the OAuth integration record

1. In Type, begin adding a NetSuite connection and copy the OAuth redirect URL shown in the form. It ends with:

   /api/oauth/integrations/callback

2. In NetSuite, go to Setup → Integration → Manage Integrations → New.

3. Enter a recognizable name, such as Type NetSuite.

4. Enable OAuth 2.0 Authorization Code Grant.

5. Add the exact Type redirect URL. The URL in NetSuite must match Type’s value exactly.

6. Enable the OAuth scope that matches the API type you will select in Type:

   • Enable REST Web Services for SuiteTalk.
   • Enable RESTlets for a RESTlet.
   • Enable both only if you will reuse this integration record for separate SuiteTalk and RESTlet connections.

7. Save the integration.

8. Copy the generated client ID and client secret. NetSuite displays the secret only when it is created.

Store these values securely. Do not paste them into Space instructions, skills, docs, or thread messages.

Configure least-privilege roles

The OAuth token acts on behalf of the NetSuite user who authorizes Type. It does not need an Administrator role.

For every connecting user:

1. Assign a role with Log in Using OAuth 2.0 Access Tokens.
2. Grant only the record, transaction, subsidiary, and field access the user needs.
3. For SuiteTalk, add the required REST Web Services permission and other permissions required by the records or queries AI will use.
4. For a RESTlet, add the role to the RESTlet deployment’s Audience and make sure the role can perform the operations used by the script.

Oracle documents OAuth 2.0 role permissions and RESTlet deployment audiences.

If employees must retain their own NetSuite permissions, each person should create a personal Type connection and authorize it with their own NetSuite account. Use an organization connection only when a shared service account is intentional.

Find your account ID and API URL

Find the account ID and account-specific domains in NetSuite under Setup → Company → Company Information → Company URLs.

Do not guess production, sandbox, or release-preview domains. Oracle recommends using the exact account-specific URLs shown in NetSuite. Sandbox account IDs commonly contain an underscore, such as 1234567_SB1; Type converts it to the hyphenated lowercase form required in endpoint hosts.

The API targets look like:

SuiteTalk REST

When you select SuiteTalk, Type uses:

https://<account-id>.suitetalk.api.netsuite.com/services/rest

RESTlet

When you select RESTlet, Type uses:

https://<account-id>.restlets.api.netsuite.com

RESTlet requests use a path similar to:

/app/site/hosting/restlet.nl?script=<script-id>&deploy=<deployment-id>

See Oracle’s account-specific URL guidance and RESTlet request example.

Connect NetSuite in Type

1. Open the Space that should use NetSuite.
2. Open Space settings → Connections.
3. Search for NetSuite.
4. Choose whether the connection is personal or available to the organization.
5. Enter the NetSuite account ID.
6. Under API type, select SuiteTalk or RESTlet.
7. Enter the NetSuite client ID and client secret.
8. Choose Connect NetSuite.
9. In the NetSuite window, sign in as the intended user and approve access.
10. Return to Type and add the connection to the Space.

Type sets the API base URL and OAuth scope from the selected API type. The authorization and token URLs remain account-specific NetSuite presets.

Give Type RESTlet instructions

SuiteTalk exposes standardized record metadata that AI can inspect. A RESTlet is a custom API, so give AI its contract before use.

Document:

• The RESTlet path, script ID, and deployment ID.
• Supported HTTP methods.
• Required query parameters and JSON body fields.
• Example successful responses.
• Error response shapes.
• Which operations are read-only and which change NetSuite data.

Add this information to a focused skill or API reference file. Never include the client secret or OAuth tokens.

Verify the connection

Start with a read-only request.

For SuiteTalk, ask:

Use NetSuite to inspect the record metadata catalog, then list five recent customer records without changing anything.

For a RESTlet, include the known path and operation:

Call the connected NetSuite RESTlet at /app/site/hosting/restlet.nl with the approved script and deployment IDs. Run its read-only health or list operation and summarize the response.

Before allowing production writes, test with a sandbox record and confirm the result in NetSuite.

Troubleshooting

• Redirect URI mismatch: Copy the redirect URL from Type again and make sure the NetSuite integration record matches it exactly.
• Invalid scope: Confirm the integration record enables the scope selected under API type: REST Web Services for SuiteTalk or RESTlets for a RESTlet.
• Permission denied: Confirm the authorizing user has Log in Using OAuth 2.0 Access Tokens, the required record permissions, and either REST Web Services permission or RESTlet deployment access.
• Wrong API host: Confirm the correct API type is selected. Type generates the SuiteTalk or RESTlet host from the account ID.
• RESTlet not found: Confirm the script and deployment IDs, deployment status, HTTP method, and Audience settings.
• Sandbox URL fails: Use the exact domain from Company URLs. Do not manually reuse a production domain or leave the sandbox underscore unchanged in a host.
• Connection worked and later expired: The access token refreshes automatically. If the refresh token expires or access is revoked in NetSuite, reconnect and authorize again.
• Records or fields are missing: NetSuite applies the authorizing user’s role, subsidiary restrictions, forms, and field permissions. Review that role instead of switching to Administrator.
• Need both SuiteTalk and a RESTlet: Create two connections with distinct names because one connection has one API base URL.