Skip to main content
The NetSuite integration connects Aperium to your NetSuite ERP over its REST and SuiteQL surfaces. Agents can read records and transactions, run analytical queries over generated datasets, and — with approval — create and update a bounded set of records. Every SuiteQL query behind the tools is a fixed, parameterized template; the agent never composes raw SQL.

​
How it connects

NetSuite offers two credential methods, selectable as tabs on the setup form:

OAuth 2.0 (default, per-user)

Authorization-code flow with PKCE, scoped to REST web services. Layered per-user: an admin registers the OAuth client once, then each user links their own NetSuite login. Per-user identity is derived from the access token.

OAuth 1.0 Token-Based Authentication (tenant-wide)

Token-Based Authentication (TBA) with a tenant-wide token that every user shares. TBA tokens don’t refresh — rotation is done by re-pasting in the admin UI.
Both methods take a single Account ID (either realm form 1234567_SB1 or URL form 1234567-sb1; Aperium derives the other form automatically).
1

Open the NetSuite setup form

In the admin onboarding flow or the Admin Console’s MCP Servers tab, open the NetSuite connector and pick the OAuth 2.0 or Token-Based Authentication tab.
2

Enter the account and credentials

Provide the Account ID and the fields for your chosen method, then click Enable. For OAuth 2.0, each user links their own account afterward from the Integrations page.

​
What agents can read

Twenty-two read tools:
  • Records — discover a record type’s schema, and get a single record (with line expansion for transactions).
  • Entity searches — customers, vendors, employees, items, and subsidiaries.
  • Transaction searches — a generic transaction reader plus typed searches for sales orders, purchase orders, invoices, vendor bills, work orders, journal entries, assembly builds, and inventory adjustments.
  • Sub-resource reads — account balance, item availability, and assembly-item BOM.
  • Reference searches — locations and accounts.

​
Query datasets

Several searches also expose queryable datasets for analytics, so counting and aggregation push down as a single SuiteQL statement:
  • GL lines — posted general-ledger accounting lines; a trial balance is one aggregate plan (filter by date, sum amounts grouped by account).
  • Transaction lines — operational lines joined to their transaction header, for cross-document line analysis.
  • Sales orders — transaction headers with a relation to their lines.

​
What agents can write

Seven write tools, all approval-gated — the agent must surface the change for a human to approve before it executes:
  • Typed writes: create customer, update customer, create sales order, create purchase order.
  • Generic writes: create, update, and delete a record — restricted to the same record-type allowlist the read tools use (not arbitrary types; contract records can’t be deleted).

​
Raw SQL is intentionally gated

The agent never authors a SuiteQL statement. The unguarded free-form query tool was removed long ago, and the guarded run_suiteql tool that briefly replaced it was also retired — the typed searches and query datasets above are the entire query surface. Every template’s interpolated values are validated and escaped before reaching NetSuite.
A separate, first-party NetSuite MCP connector is also available. It routes through NetSuite’s official managed MCP server and likewise withholds raw SuiteQL tools.