Oracle NetSuite authenticates SuiteTalk machine-to-machine clients with a signed JWT and a certificate mapping. Sim stores the SuiteTalk URL, Client ID, Certificate ID, and private key as one encrypted service-account credential. Every NetSuite block stores only that credential's ID; Sim signs the assertion and injects the short-lived access token on the server.
Prerequisites
- A dedicated NetSuite integration role with REST Web Services and Log in using OAuth 2.0 Access Tokens, plus the record and SuiteAnalytics permissions your workflows require.
- An integration record with Client Credentials (Machine to Machine) Grant and the REST Web Services scope enabled.
- A 3072- or 4096-bit RSA key pair, or a P-256, P-384, or P-521 EC key pair, and a public certificate generated through your organization's certificate process.
- Access to OAuth 2.0 Client Credentials (M2M) Setup and Company URLs in the target NetSuite environment.
Create and map credentials separately in production, sandbox, and Release Preview. A sandbox refresh removes its OAuth 2.0 client-credential mappings, and each environment has a different authoritative SuiteTalk URL.
Configure NetSuite
In Setup → Company → Enable Features, enable REST Web Services and OAuth 2.0. Enable SuiteAnalytics Workbook if workflows will use datasets.
Create a dedicated integration role and grant only the record, transaction, subsidiary, and analytics permissions the workflows need. Avoid using Administrator.
Under Setup → Integration → Manage Integrations, create or edit an integration, enable the machine-to-machine client-credentials grant and REST Web Services scope, then save its Client ID.
Upload only the public certificate under OAuth 2.0 Client Credentials (M2M) Setup. Map it to the integration, entity, and dedicated role, then save the generated Certificate ID. Keep the private key outside NetSuite.
Under Setup → Company → Company Information → Company URLs, copy the complete SuiteTalk (SOAP and REST Web Services) URL for this environment.
Oracle documents the role setup, integration record, certificate requirements, and client-credential mapping.
Add the Credential to Sim
Add an Oracle NetSuite block to a workflow and open the NetSuite Account dropdown.
Choose to add a credential, then enter the authoritative SuiteTalk URL, Client ID, Certificate ID, and PEM private key that matches the uploaded certificate.
Save the credential. Sim validates the URL and key policy, signs a client assertion, and performs a real token exchange before storing the encrypted credential.
The private key is encrypted at rest and is never returned through the token endpoint or injected into a workflow tool. At execution time, Sim resolves the selected credential to a short-lived bearer token and the normalized SuiteTalk origin.
Use Pickers and Manual Values
Selecting the credential enables these account-backed fields:
| Field | Lists | Additional scope |
|---|---|---|
| Record Type | Up to 1,000 record types visible in the metadata catalog | credential |
| Async Task | Up to 100 tasks belonging to a known batch job | job ID |
Picker results reflect the selected role's permissions. Switch any picker to Advanced mode to type an identifier or reference an upstream output. Enter SuiteAnalytics dataset IDs manually after finding them with List SuiteAnalytics Datasets. Record IDs, job IDs, transform targets, actions, fields, forms, subresources, and relationship IDs also remain manual because NetSuite does not expose bounded universal listings that would make those choices complete and reliable.
Create Record without replace returns HTTP 204 with no response body; with replace, it returns HTTP 201 and the created record object. Both responses expose NetSuite's validated location. The replace option applies to create and update, not upsert.
Rotate or Revoke
To rotate a certificate, create and upload the replacement certificate and create its new NetSuite mapping. Then reconnect the existing Sim credential by re-entering all four required fields: SuiteTalk URL, Client ID, the new Certificate ID, and the replacement private key. Reconnecting changes the encrypted credential fingerprint, so later executions mint against the new material.
After confirming workflows succeed, remove the old certificate mapping in NetSuite so the previous certificate can no longer mint tokens. Deleting a Sim credential removes its workflow bindings but does not revoke the corresponding NetSuite certificate mapping.