NetSuite SuiteAnalytics (Edge)

Token-based Authentication (TBA) allows Hevo to securely connect to your NetSuite account using access tokens generated in NetSuite.

To use this method, you must complete the following steps in order:

1. Enable SuiteScript and TBA for your NetSuite account

2. Create an integration record with TBA permissions

3. Create a role for Hevo and assign permissions

4. Configure a user for Hevo and assign role

5. Create an access token

Perform the following steps to obtain the required credentials to connect Hevo to your NetSuite account using token-based authentication:

1. Enable SuiteScript and Token-based authentication

To allow token-based authentication, you must enable the required SuiteScript and TBA features in your NetSuite account. To do this:

1. Log in to your NetSuite account.

2. In the top navigation bar, hover over Setup and click Company.

   

3. Under the SETUP TASKS section, click Enable Features.

   

4. On the Enable Features page, scroll to the SuiteCloud section and do the following:

   1. In the SuiteScript section, do the following:

      

      1. Select the check box next to Client SuiteScript.

      2. Click I Agree to accept the NetSuite Terms of Service displayed in a new tab.

      3. Select the check box next to Server SuiteScript.

      4. Click I Agree to accept the NetSuite Terms of Service displayed in a new tab.

   2. Scroll to the Manage Authentication section and select the check box next to Token-based Authentication.

      

   3. Click I Agree to accept the NetSuite Terms of Service displayed in a new tab.

   4. Scroll to the bottom of the page and click Save.

You have successfully enabled the required features for token-based authentication in your NetSuite account. Proceed to create an integration record with token-based authentication permissions.

2. Create an integration record with Token-based authentication permissions

To establish a connection between Hevo and your NetSuite account, you must create an integration record with token-based authentication enabled. This record helps Hevo identify itself during authentication.

Perform the following steps to create an integration record:

1. In the top navigation bar, hover over Setup and click Integration.

   

2. Under the INTEGRATION MANAGEMENT section, hover over Manage Integrations and click New.

   

3. On the Integration page, do the following:

   

   1. Specify a unique name for the integration. For example, HevoToken.

   2. Under the Authentication tab, select the check box next to Token-based Authentication to allow Hevo to access your NetSuite account data.

   3. Click Save.

   A confirmation message is displayed on the screen indicating that the integration is successfully created and saved.

   

4. Scroll to the Client Credentials section and copy the Consumer Key / Client ID and Consumer Secret / Client Secret. Save these values securely like any other password.

   The Consumer Key / Client ID and Consumer Secret / Client Secret are displayed only once for security reasons. Once you leave the Integration page, they cannot be retrieved. Never share these credentials via email or with unauthorized individuals. If the credentials are lost, you must create a new integration record and modify the Source configuration in the Pipeline with valid credentials.

   

   Use these credentials while configuring your NetSuite SuiteAnalytics Source in the Pipeline. Proceed to create a role for Hevo and assign permissions.

3. Create a role for Hevo and assign permissions

To allow Hevo to access data from your NetSuite account, you must create a dedicated role with the required permissions. This role determines the data that Hevo can access for replication.

Perform the following steps to create the role and assign the required permissions:

1. In the top navigation bar, hover over Setup and click Users/Roles.

   

2. Under the USER MANAGEMENT section, hover over Manage Roles and click New.

   

3. On the Role page, do the following:

   1. In the Name field, specify a name for the role. For example, HevoRole.

      

   2. Scroll to the Permissions tab and click the Setup tab.

      

   3. From the Permission drop-down, select Log in using Access Tokens, and then click Add. This permission allows Hevo to authenticate with your NetSuite account using token-based or OAuth 2.0 credentials.

      

   4. From the Permission drop-down, select SuiteAnalytics Connect, and then click Add. This permission allows Hevo to connect to the NetSuite2.com data source and access your data for replication through the SuiteAnalytics Connect service.

   5. Click Save.

      

You are redirected to the Manage Roles page, where the role you created appears as a new row. You can now assign this role to a NetSuite user.

4. Configure a user for Hevo and assign role

You must assign the role you created in the Create a role for Hevo and assign permissions section to a NetSuite user so Hevo can authenticate and access data. Depending on your NetSuite setup, either configure an existing user or create one for Hevo.

Note: Avoid using a NetSuite user that is already used for other integrations. We recommend creating a dedicated user for Hevo so that credentials can be managed independently and access can be revoked without impacting other integrations.

• If the user already exists:

  1. In the top navigation bar, hover over Setup and click Users/Roles.

     

  2. Under the USER MANAGEMENT section, click Manage Users.

     

  3. On the Manage Users page, click the user you want to configure for Hevo.

     

  4. On the Employee page, click Edit.

     

  5. Click the Access tab and do the following:

     1. Select the check box next to Give Access.

        

     2. In the Roles tab, do the following:

        

        1. From the Role drop-down, select the role that you created in the Create a role for Hevo and assign permissions section, and then click Add.

        2. From the Role drop-down, select Data Warehouse Integrator, and then click Add. This role provides the required access to NetSuite data for extraction using the SuiteAnalytics Connect service.

     3. Click Save.

     A confirmation message is displayed on the screen indicating that the the employee record is successfully updated and saved.

     

• If you need to create a new user:

  1. In the top navigation bar, hover over Lists and click Employees.

     

  2. In the sub-menu, hover over Employees and click New.

     

  3. On the Employee page, do the following:

     1. Specify the following:

        

        • Name: A unique name for the user.

        • Email: The email address used for login access and account-related notifications.

     2. Scroll to the Classification section, and from the Subsidiary drop-down, select the subsidiary for which the user is being created. This determines the data and records the user can access based on the selected subsidiary. For example, here, we are selecting Parent Company.

        Note: Ensure you select the correct subsidiary. An incorrect selection will restrict the data Hevo can access during replication.

        

     3. Click the Access tab, and do the following:

        1. Select the check box next to Give Access.

           

        2. In the Roles tab, do the following:

           

           1. From the Role drop-down, select the role that you created for Hevo in the Create a role for Hevo and assign permissions section, and then click Add.

           2. From the Role drop-down, select Data Warehouse Integrator, and then click Add. This role provides the required access to NetSuite data for extraction using the SuiteAnalytics Connect service.

        3. Click Save.

        A confirmation message is displayed on the screen indicating that the the employee record is successfully created and saved.

        

You have successfully configured a user for Hevo. Proceed to generate access tokens for authentication.

5. Create an access token

To complete token-based authentication setup, you must create an access token associated with the integration record, user, and role you configured in the previous steps. This generates the Token ID and Token Secret required to establish the connection.

Perform the following steps to create an access token:

1. In the top navigation bar, hover over Setup and click Users/Roles.

   

2. Under the USER MANAGEMENT section, hover over Access Tokens and click New.

   

3. On the Access Token page, do the following:

   

   1. From the Application Name drop-down, select the integration record that you created in the Create an integration record with token-based authentication permissions section.

   2. From the User drop-down, select the user that you configured in the Configure a user for Hevo and assign role section.

   3. From the Role drop-down, select the role that you created in the Create a role for Hevo and assign permissions section.

   4. In the Token Name field, specify a unique name for the token. For example, HevoAccessToken.

   5. Click Save.

   A confirmation message is displayed on the screen indicating that the token is successfully created and saved.

   

4. Scroll to the Token Id / secret section and copy the Token Id and Token Secret. Save these values securely like any other password.

   The Token ID and Token Secret are displayed only once for security reasons. Once you leave the Access Token page, they cannot be retrieved. Never share these credentials via email or with unauthorized individuals. If the credentials are lost, you must generate new tokens and modify the Source configuration in the Pipeline with valid credentials.

   

You now have all the credentials required for token-based authentication:

• Account ID

• Consumer Key

• Consumer Secret

• Token ID

• Token Secret

Use them while configuring your NetSuite SuiteAnalytics Source in the Pipeline.

OAuth 2.0 authentication allows Hevo to securely connect to your NetSuite account using a client-based authentication flow, where Hevo verifies its identity using a certificate before accessing your data. This method is recommended if your organization requires certificate-based authentication or follows strict security guidelines.

Note: If you prefer a simpler setup that does not require managing certificates, consider using token-based authentication instead.

To use this method, you must complete the following steps in order:

• Enable SuiteScript and OAuth 2.0 for your NetSuite account

• Create an integration record with OAuth 2.0 permissions

• Create a role for Hevo and assign permissions

• Configure a user for Hevo and assign role

• Generate certificates for authentication

• Upload the public certificate in NetSuite

Perform the following steps to obtain the required credentials to connect Hevo to your NetSuite account using OAuth 2.0 authentication:

1. Enable SuiteScript and OAuth 2.0

To allow OAuth 2.0 authentication, you must enable the required SuiteScript and OAuth features in your NetSuite account. To do this:

1. Log in to your NetSuite account.

2. In the top navigation bar, hover over Setup and click Company.

   

3. Under the SETUP TASKS section, click Enable Features.

   

4. On the Enable Features page, scroll to the SuiteCloud section and do the following:

   1. In the SuiteScript section, do the following:

      

      1. Select the check box next to Client SuiteScript.

      2. Click I Agree to accept the NetSuite Terms of Service displayed in a new tab.

      3. Select the check box next to Server SuiteScript.

      4. Click I Agree to accept the NetSuite Terms of Service displayed in a new tab.

   2. Scroll to the Manage Authentication section and select the check box next to OAuth 2.0.

      

   3. Click I Agree to accept the NetSuite Terms of Service displayed in a new tab.

   4. Scroll to the bottom of the page and click Save.

You have successfully enabled the required features for OAuth 2.0 authentication in your NetSuite account. Proceed to create an integration record with OAuth 2.0 permissions.

2. Create an integration record with OAuth 2.0 permissions

To establish a connection between Hevo and your NetSuite account, you must create an integration record with OAuth 2.0 enabled. This record helps Hevo identify itself during authentication.

Perform the following steps to create an integration record:

1. In the top navigation bar, hover over Setup and click Integration.

   

2. Under the INTEGRATION MANAGEMENT section, hover over Manage Integrations and click New.

   

3. On the Integration page, do the following:

   

   1. Specify a unique name for the integration. For example, HevoToken.

   2. Under the Authentication tab, in the OAuth 2.0 section, select the check boxes next to Client Credentials (Machine To Machine) Grant and SuiteAnalytics Connect to allow Hevo to access your NetSuite account data.

   3. Click Save.

   A confirmation message is displayed on the screen indicating that the integration is successfully created and saved.

   

4. Scroll to the Client Credentials section and copy the Consumer Key / Client ID. Save this value securely like any other password.

   The Consumer Key / Client ID is displayed only once for security reasons. Once you leave the Integration page, it cannot be retrieved. Never share this credential via email or with unauthorized individuals. If the credential is lost, you must create a new integration record and modify the Source configuration in the Pipeline with valid credentials.

   

   Use the Client ID while configuring your NetSuite SuiteAnalytics Source in the Pipeline. Proceed to create a role for Hevo and assign permissions.

3. Create a role for Hevo and assign permissions

To allow Hevo to access your NetSuite data using OAuth 2.0, you must create a dedicated role with the required permissions for this authentication method. These permissions allow Hevo to authenticate the connection using tokens and access data using the SuiteAnalytics Connect service.

Perform the following steps to create the role and assign the required permissions:

1. In the top navigation bar, hover over Setup and click Users/Roles.

   

2. Under the USER MANAGEMENT section, hover over Manage Roles and click New.

   

3. On the Role page, do the following:

   1. In the Name field, specify a name for the role . For example, HevoRole.

      

   2. Scroll to the Permissions tab and click the Setup tab.

      

   3. From the Permission drop-down, select Log in using Access Tokens, and then click Add. This permission allows Hevo to authenticate with your NetSuite account using token-based or OAuth 2.0 credentials.

      

   4. From the Permission drop-down, select SuiteAnalytics Connect, and then click Add. This permission allows Hevo to connect to the NetSuite2.com data source and access your data for replication through the SuiteAnalytics Connect service.

   5. Click Save.

      

You are redirected to the Manage Roles page, where the role you created appears as a new row. You can now assign this role to a NetSuite user.

4. Configure a user for Hevo and assign role

You must assign the role you created in the Create a role for Hevo and assign permissions section to a NetSuite user so Hevo can authenticate and access data. Depending on your NetSuite setup, either configure an existing user or create one for Hevo.

Note: Avoid using a NetSuite user that is already used for other integrations. We recommend creating a dedicated user for Hevo so that credentials can be managed independently and access can be revoked without impacting other integrations.

• If the user already exists:

  1. In the top navigation bar, hover over Setup and click Users/Roles.

     

  2. Under the USER MANAGEMENT section, click Manage Users.

     

  3. On the Manage Users page, click the user you want to configure for Hevo.

     

  4. On the Employee page, click Edit.

     

  5. Click the Access tab and do the following:

     1. Select the check box next to Give Access.

        

     2. In the Roles tab, do the following:

        

        1. From the Role drop-down, select the role that you created in the Create a role for Hevo and assign permissions section, and then click Add.

        2. From the Role drop-down, select Data Warehouse Integrator, and then click Add. This role provides the required access to NetSuite data for extraction using the SuiteAnalytics Connect service.

     3. Click Save.

     A confirmation message is displayed on the screen indicating that the the employee record is successfully updated and saved.

     

• If you need to create a new user:

  1. In the top navigation bar, hover over Lists and click Employees.

     

  2. In the sub-menu, hover over Employees and click New.

     

  3. On the Employee page, do the following:

     1. Specify the following:

        

        • Name: A unique name for the user.

        • Email: A valid, accessible email address for login access and account-related notifications.

     2. Scroll to the Classification section, and from the Subsidiary drop-down, select the subsidiary for which the user is being created. This determines the data and records the user can access based on the selected subsidiary. For example, here, we are selecting Parent Company.

        Note: Ensure you select the correct subsidiary. An incorrect selection will restrict the data Hevo can access during replication.

        

     3. Click the Access tab, and do the following:

        1. Select the check box next to Give Access.

           

        2. In the Roles tab, do the following:

           

           1. From the Role drop-down, select the role that you created for Hevo in the Create a role for Hevo and assign permissions section, and then click Add.

           2. From the Role drop-down, select Data Warehouse Integrator, and then click Add. This role provides the required access to NetSuite data for extraction using the SuiteAnalytics Connect service.

           3. Click Save.

           A confirmation message is displayed on the screen indicating that the the employee record is successfully created and saved.

           

You have successfully configured a user for Hevo. Proceed to generate certificates for authentication.

5. Generate certificates for authentication

To enable secure authentication using OAuth 2.0, you must generate a private key and a corresponding public certificate. The private key is used by Hevo to verify its identity during authentication, and must be kept secure. The public certificate is uploaded to NetSuite to establish connection between Hevo and your NetSuite account.

Perform the following steps to generate the certificates:

1. Open a terminal window on your machine.

2. Run the following command to generate a private key (private_key.pem) and a public certificate (public_cert.pem):

   openssl req -new -x509 -newkey rsa:2048 -keyout private_key.pem -out public_cert.pem -nodes -days 365
   

   This command performs the following actions:

   • -newkey rsa:2048: Creates a 2048-bit RSA private key, which is used by Hevo to authenticate its identity.

   • -keyout private_key.pem: Saves the generated private key to a file on your machine.

   • -x509: Uses the private key to generate a self-signed public certificate,

   • -out public_cert.pem: Saves the generated public certificate to a file, which you will upload to NetSuite.

3. Specify the details as per your organization’s information. This data will be embedded in the CA certificate to uniquely identify it.

   

   Once the command executes successfully, both files are generated and saved in your current directory.

   Use the private key while configuring your NetSuite SuiteAnalytics Source in the Pipeline. Proceed to upload the public certificate to NetSuite to complete the OAuth 2.0 setup.

   The private key (private_key.pem) is highly sensitive and must be stored securely. Do not share it with anyone. If the private key is lost or compromised, you must regenerate both files and re-upload the public certificate to NetSuite.

6. Upload the public certificate in NetSuite

To complete the OAuth 2.0 setup, you must upload the generated public certificate in NetSuite and associate it with the required user, role, and integration record. This step generates the certificate ID required for configuring your Source in the Pipeline.

Perform the following steps to upload the certificate:

1. In the top navigation bar, hover over Setup and click Integration.

   

2. Under the Manage Authentication section, click OAuth 2.0 Client Credentials (M2M) Setup.

   

3. On the OAuth 2.0 Client Credentials Setup page, click Create New.

   

4. In the Create a New Client Credentials Mapping dialog box, do the following:

   

   1. From the ENTITY drop-down, select the user that you configured in the Configure a user for Hevo and assign role section.

   2. From the ROLE drop-down, select the role that you created in the Create a role for Hevo and assign permissions section.

   3. From the APPLICATION drop-down, select the integration record that you created in the Create an integration record with OAuth 2.0 permissions section.

   4. In the CERTIFICATE field, click Choose a file and upload the public certificate (publickey.pem) saved on your machine.

   5. Click Save.

      Once saved, NetSuite registers the certificate and associates it with the selected user, role, and integration record. The newly created certificate is displayed as a row on the OAuth 2.0 Client Credentials Setup page.

5. Copy the CERTIFICATE ID of your certificate and save it securely like any other password.

   

You now have all the credentials required for OAuth 2.0 authentication:

• Client ID

• Certificate ID

• Private Key.

Use them while configuring your NetSuite SuiteAnalytics Source in the Pipeline.