NetSuite

Finance Token-based auth, or OAuth

Read and post NetSuite records, and run SuiteQL queries, from any Windmill script, flow or app.

Set up in 4 steps

Note your account id

It is the identifier in your NetSuite URL — something like 1234567 or 1234567_SB1 for a sandbox. Every call is built from it, whichever authentication you choose.

Create an integration and access token

In NetSuite, enable Token-Based Authentication, create an integration record for its consumer key and secret, then create an access token for a role — that gives the token id and secret.

Add the resource in Windmill

Open Resources, add a resource of type netsuite, and fill account_id plus either the four token-based fields, or a bearer token if you connect with OAuth instead.

Run your first script

Fork any script below and read a record before posting anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Resource type

The shape of the credential every script on this page expects.

netsuite

View raw schema →

Field	Type	Required	What it is
account_id	string	Yes	NetSuite account ID as it appears in your account-specific domain, e.g. 1234567 or 1234567-sb1 for a sandbox (Setup > Company > Company Information > Account ID). Used to build https://<account_id>.suitetalk.api.netsuite.com.
consumer_key	string	No	TBA consumer key of an integration record (Setup > Integration > Manage Integrations, with Token-Based Authentication checked). Leave blank when using an OAuth 2.0 token.
consumer_secret	string	No	TBA consumer secret of the integration record. Leave blank when using an OAuth 2.0 token.
token_id	string	No	TBA token ID of an access token (Setup > Users/Roles > Access Tokens) created for the integration record. Leave blank when using an OAuth 2.0 token.
token_secret	string	No	TBA token secret of the access token. Leave blank when using an OAuth 2.0 token.
token	string	No	OAuth 2.0 access token (Bearer). Populated automatically when you connect via Windmill's NetSuite OAuth flow, or paste one manually. Provide this instead of the TBA fields. Note: NetSuite OAuth 2.0 refresh tokens are single-use and valid for 2 days by default (configurable up to 30 days on the integration record), so a connection left unused longer than that must be reconnected — prefer TBA for unattended schedules.

Questions

Which authentication should I use?

Either. Token-based auth signs each request with the four consumer and token fields and does not expire; OAuth stores a bearer token instead. Fill one set, not both.

Sandbox or production?

The account id decides — a sandbox one carries a _SB suffix and resolves to a different host. Keep a resource for each.

A record type is not found

NetSuite exposes records per role and per enabled feature. A missing record type is usually the role's permissions rather than a wrong name.

Is my credential stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.

Set up in 4 steps

Note your account id

Create an integration and access token

Add the resource in Windmill

Run your first script

Scripts

Update Record

List Records

List Record Types

Get Record Schema

Get Record

Execute SuiteQL

Delete Record

Create Record

Resource type

netsuite

Questions