Integrations

Connecting NetSuite

View as Markdown

The Tabs and NetSuite integration lets Tabs sync invoicing, customer, and accounting data with NetSuite.

Once connected, Tabs can:

  • Sync customers between systems
  • Push invoices and credit memos to NetSuite
  • Import products and chart of accounts from NetSuite
  • Push journal entries during month-end close workflows

Credit memos are push-only. Apply a Tabs-created credit memo in Tabs, not in NetSuite. Applying it in NetSuite returns to Tabs as a payment and leaves the credit memo open. See Applying a credit memo in your ERP instead of in Tabs.

Do not map OAuth 2.0 to the NetSuite Administrator role. Install Tabs Platform Automation, then map the certificate to a dedicated Tabs user with Tabs Integration Role.

Before you start

You need:

  • NetSuite Administrator access — only an Administrator can install the SuiteApp, enable REST Web Services and OAuth 2.0, create the machine-to-machine (M2M) integration record, and upload the certificate
  • Admin access in Tabs
  • The NetSuite subsidiary this Tabs instance should connect to

Install Tabs Platform Automation (com.tabsplatform.automation) in each NetSuite account you will connect (production and sandbox separately). If you connect a sandbox, make sure it has been synced with production within the last few months.

Step 1: Install Tabs Platform Automation and create a dedicated user

A NetSuite Administrator installs the SuiteApp, then creates a dedicated employee for Tabs.

Install the SuiteApp

  1. In NetSuite, go to SuiteApps
  2. Search for Tabs Platform Automation or com.tabsplatform.automation
  3. Open the SuiteApp and click Install
  4. Confirm Tabs Integration Role exists under Setup → Users/Roles → Manage Roles

If the SuiteApp is not listed, contact your Tabs implementation manager for the install package. Do not substitute Administrator or another custom role.

Create the Tabs integration user

  1. From NetSuite Home, go to Lists → Employees → New
  2. Set the email to ns-integrations+[merchant]@tabs.inc, replacing [merchant] with your company name
  3. Check Give Access. Send Notification Email is optional for a machine user.
  4. On Access, assign Tabs Integration Role. Do not assign Administrator.
  5. Save

Tabs Integration Role is web-services-only. It is not for UI login. OAuth 2.0 M2M uses the user and role mapping, not an interactive session.

Step 2: Enable features and create an integration record

A NetSuite Administrator enables REST Web Services and OAuth 2.0, then creates the M2M integration record.

Enable the features

  1. In NetSuite, go to Setup → Company → Enable Features → SuiteCloud
  2. Under SuiteTalk (Web Services), enable REST Web Services
  3. Under Manage Authentication, enable OAuth 2.0

Create an integration record

  1. In NetSuite, go to Setup → Integration → Manage Integrations → New
  2. Under OAuth 2.0, enable the Client Credentials (Machine to Machine) Grant with the REST Web Services scope. Leave Authorization Code Grant unchecked.
  3. Under Token-based Authentication, leave TBA: Authorization Flow unchecked.
  4. Save, then copy the Consumer Key / Client ID. You don’t need the Consumer Secret / Client Secret.

Step 3: Generate a certificate in Tabs

  1. Go to Integrations in Tabs
  2. Click Connect on the NetSuite tile
  3. Click Generate Certificate
  4. Download the .pem file to upload in NetSuite

The certificate is valid for about two years. Regenerating it is both how you renew it and how you recover a lost .pem file. Either way the new certificate has to be uploaded to NetSuite, and regenerating drops the connection back to pending until you do, so treat it as a reset rather than a refresh.

Step 4: Upload the certificate in NetSuite

  1. In NetSuite, go to Setup → Integration → OAuth 2.0 Client Credentials (M2M) Setup → Create New
  2. Upload the certificate you downloaded from Tabs
  3. Map it as follows, then save:
    • Entity / user: the dedicated Tabs employee from Step 1
    • Role: Tabs Integration Role — not Administrator
    • Application: the M2M integration record from Step 2
  4. Copy the Certificate ID — you’ll enter it later in this flow

REST Web Services must be enabled on the mapped role. NetSuite can issue an access token even when the role cannot call the API; the first REST call then fails. Tabs Integration Role includes the required REST access — do not map the certificate to a role that lacks it.

Step 5: Note your NetSuite Account ID

Find it in NetSuite under Setup → Company → Company Information (the Account ID field), or read it from your NetSuite URL — for example 1234567 (1234567_SB1 for a sandbox).

Step 6: Enter your NetSuite IDs in Tabs

  1. Return to NetSuite setup in Tabs
  2. Go to Step 2 of the Tabs flow
  3. Enter the three IDs:
    • Account ID — your NetSuite account ID (the host in your NetSuite URL)
    • Client ID — from the integration record with Client Credentials (M2M) enabled
    • Certificate ID — from the OAuth 2.0 Client Credentials (M2M) mapping after uploading the certificate
  4. Click Connect to NetSuite

Once connected, the NetSuite tile changes from Connect to Set up NetSuite.

Step 7: Complete Set up NetSuite

No NetSuite data syncs until this step is saved.

  1. Click Set up NetSuite
  2. Choose the subsidiary Tabs should map to. Select Root subsidiary to apply no filtering and import across every subsidiary, which is the right choice when your account is not on OneWorld.
  3. Choose Create Sales Order or Invoice Only (Don’t Create Sales Order)
  4. Save

Both choices lock when you save. Changing the subsidiary or the sales-order setting afterward requires Tabs Support, so confirm them before you save.

If you choose Create Sales Order, Tabs creates a contract’s sales order when the first invoice for that contract is sent, not when the contract is approved or processed. Later invoices for the same contract attach to that existing sales order rather than creating another one, and appear under its Related Records in NetSuite.

Once setup is complete, a sync is automatically triggered to pull data from NetSuite. See What syncs for what data moves between NetSuite and Tabs.

If the subsidiary list won’t load

The subsidiary list is read with a query, so a role without the right permissions produces an error instead of an empty dropdown, and Save stays disabled. Tabs Integration Role already grants what’s needed, so this usually means the certificate was mapped to a different role. Two permissions matter, both under Setup → Users/Roles → Manage Roles:

  • Reports → SuiteAnalytics Workbook, without which NetSuite refuses the query outright
  • Lists → Subsidiaries with at least View, without which NetSuite reports Record 'SUBSIDIARY' was not found

That second message is indistinguishable from an account that genuinely has no subsidiaries because it is not on OneWorld. If the permission is granted and the list still won’t load, contact Tabs Support rather than guessing.