Netsuite CRM

This article outlines the integration with the NetSuite CRM connector, enabling streamlined metadata management through features such as crawling, sample profiling, manual lineage, and data preview. The connector extracts metadata from NetSuite CRM record types, tables, columns, custom subrecords, and hierarchical relationships, providing comprehensive visibility into CRM metadata and its structure.

The connector establishes connectivity through the NetSuite SuiteTalk REST APIs using OAuth 1.0 Token-Based Authentication (TBA). Authentication is performed using a NetSuite integration record and a dedicated service account with the required REST Web Services and SuiteQL permissions for connection validation, metadata crawling, sample profiling, data preview, and related connector operations.

Overview

Connector Details

Connector Category	RDBMS
OvalEdge Release Supported	Release8.0 and later
Connectivity [How the connection is established with NetSuite CRM]	REST APIs

Connector Features

Feature	Availability
Crawling	✅
Delta Crawling	❌
Profiling	❌
Sample Profiling	✅
Query Sheet	❌
Data Preview	✅
Auto Lineage	❌
Manual Lineage	✅
Secure Authentication via Credential Manager	✅
Data Quality	❌
DAM (Data Access Management)	❌
Bridge	✅

Metadata Mapping

The following objects are crawled from NetSuite CRM and mapped to the corresponding UI assets.

NetSuite CRM Object	NetSuite CRM Attribute	OvalEdge Attribute	OvalEdge Category	OvalEdge Type
Schema	Schema Name	Schema	Databases	Schema
Schema	Schema Comment	Source Description	Databases	Schema
Table	Record Type Name	Table	Tables	Table
Table	Record Type/Table Type	Type	Tables	Table
Table	Record Description	Source Description	Descriptions	Source Description
Table	Object Property Name	Table	Tables	Table
Table	Custom Record Schema Name	Table	Tables	Table
Columns	Property Name (Field Key)	Column	Table Columns	-
Columns	JSON Schema Type	Column Type	Table Columns	-
Columns	Property Title	Title	Table Columns	-
Columns	Property Description	Source Description	Table Columns	-
Columns	Ordinal Position	Column Position	Table Columns	-
Columns	Length	Data Type Size	Table Columns	-
Relationship Column (Synthetic)	Parent Table Name	Column	Table Columns	-
Column Relations	Parent ↔ Child Object Table	Relationship	Relationships	-

Set up a Connection

Prerequisites

The prerequisites to establish a connection:

External Supporting Files

The required external JAR files are included as part of the OvalEdge installation artifacts. For driver installation and configuration details, refer to the Connector Drivers Setup Guide. Please contact the OvalEdge Team for assistance related to the driver files and configuration setup.

Service Account User Permissions

Use a dedicated service account to establish the connection to the data source, configured with the following minimum set of permissions.

👨‍💻 Who can provide these permissions? The NetSuite CRM administrator grants these permissions, as standard accounts may not have the required access to assign them independently.

Operations	Objects	System Tables	Access Permissions
Connection Validation	SuiteTalk REST API	OPTIONS /services/rest/*	OPTIONS (Read)
Connection Validation	Schema	OPTIONS /services/rest/*	OPTIONS (Read)
Crawling	Tables (Record Types)	GET /services/rest/record/v1/metadata-catalog	GET (Read)
Crawling	Table Columns	GET /services/rest/record/v1/metadata-catalog	GET (Read)
Crawling	Custom Subrecords	GET /services/rest/record/v1/metadata-catalog (swagger)	GET (Read)
Crawling	Relationships	Derived From Metadata	Read (Metadata)
Profiling	Tables (Sample Data)	POST /services/rest/query/v1/suiteql	POST (Read)
Profiling	Tables (Row Count) / Table Columns	POST /services/rest/query/v1/suiteql	POST (Read)
-	Views, Procedures, Functions, Triggers, Query Sheet, Lineage, Indexes	N/A	Not Supported

• The NetSuite service account must use OAuth 1.0 Token-Based Authentication (TBA) with an Integration record that has TBA enabled. The assigned role must include REST Web Services permission to authenticate and access NetSuite REST metadata.

• Crawling metadata requires the role to have access to the target record types and their metadata definitions. Custom record metadata is retrieved through the NetSuite REST schema APIs.

• Profiling and Data Preview use SuiteQL and require SuiteAnalytics / SuiteQL permissions, along with access to the target records. Only Sample Profiling is supported.

• Relationship metadata is derived from nested REST object schemas and does not require additional API permissions. Auto Lineage, SQL Query execution, and Data Access features are not supported by this connector.

Connection Configuration Steps

Users must have the Connector Creator role to configure a new connection.

1. Log in to OvalEdge, go to Administration > Connectors, click + (New Connector), search for NetSuite CRM, and complete the required parameters.

   Note: Fields marked with an asterisk (*) are mandatory for establishing a connection.

Field Name	Description
Connector Type	By default, "NetSuite CRM" is displayed as the selected connector type.
Credential Manager*	Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on the selection. Supported Credential Managers: Database HashiCorp AWS Secrets Manager Azure Key Vault For more details, click here.
Connector Name*	Enter a unique name for the NetSuite CRM connection (Example: "NetSuiteCRM_Prod").
Connector Environment	Select the environment (Example: PROD, STG) configured for the connector. For more details, click here.
Connector Description	Enter the description related to the connector.
Netsuite account Id*	Enter the unique NetSuite Account ID associated with the NetSuite CRM instance.
Client/Consumer Id*	Enter the OAuth 1.0 Consumer ID (Consumer Key) generated from the NetSuite Integration record.
Client/Consumer Secret*	Enter the OAuth 1.0 Consumer Secret associated with the NetSuite integration application.
Token Id*	Enter the Token ID generated for Token-Based Authentication (TBA) in the NetSuite account.
Token secret*	Enter the Token Secret generated for the Token-Based Authentication (TBA) access token in NetSuite.
Realm Id*	Enter the NetSuite Realm ID (Account ID) in the Account_ID format to identify the NetSuite account to connect to.
Plugin Server	Enter the server name when running as a plugin server.
Plugin Port	Enter the port number on which the plugin is running.

Default Governance Roles

Default Governance Roles*	Select the appropriate users or teams for each governance role from the drop-down list. All users and teams configured in OvalEdge Security are displayed for selection.

Admin Roles

Admin Roles*	Select one or more users from the dropdown list for Integration Admin and Security & Governance Admin. All users configured in OvalEdge Security are available for selection.

No of Archive Objects

No Of Archive Objects*	This shows the number of recent metadata changes to a dataset at the source. By default, it is off. To enable it, toggle the Archive button and specify the number of objects to archive. Example: Setting it to 4 retrieves the last four changes, displayed in the 'Version' column of the 'Metadata Changes' module.

Bridge

Select Bridge*	If applicable, select the bridge from the drop-down list. The drop-down list displays all active bridges configured in OvalEdge. These bridges enable communication between data sources and OvalEdge without altering firewall rules.

1. After entering all connection details, the following actions can be performed:

   1. Click Validate to verify the connection.

   2. Click Save to store the connection for future use.

   3. Click Save & Configure to apply additional settings before saving.

2. The saved connection will appear on the Connectors home page.

Manage Connector Operations

Crawl/Profile

To perform crawl and profile operations, users must be assigned the Integration Admin role.

The Crawl/Profile button allows users to select one or more schemas for crawling and profiling.

1. Navigate to the Connectors page and click Crawl/Profile.

2. Select the schemas to crawl.

3. The Crawl option is selected by default. Click the Crawl & Profile radio button to enable both operations.

4. Click Run to collect metadata from the connected source and load it into the Data Catalog.

5. After a successful crawl, the information appears in the Data Catalog > Databases tab.

The Schedule checkbox allows automated crawling and profiling at defined intervals, from a minute to a year.

1. Click the Schedule checkbox to enable the Select Period drop-down.

2. Select a time period for the operation from the drop-down menu.

3. Click Schedule to initiate metadata collection from the connected source.

4. The system will automatically execute the selected operation (Crawl or Crawl & Profile) at the scheduled time.

Other Operations

The Connectors page in OvalEdge provides a centralized view of all configured connectors, including their health status.

Managing connectors includes:

• Connectors Health: Displays the current status of each connector, with a green icon for active connections and a red icon for inactive connections, helping monitor connectivity to data sources.

• Viewing: Click the Eye icon next to the connector name to view connector details, including Tables, Views, and Columns.

Nine Dots Menu Options:

To view, edit, validate, configure, or delete connectors, click on the Nine Dots menu.

• Edit Connector: Update and revalidate the data source.

• Validate Connector: Check the integrity of the connection.

• Settings: Modify connector settings.

  • Crawler: Configure data extraction.

  • Profiler: Customize data profiling rules and methods.

  • Access Instructions: Add notes on how data can be accessed.

  • Business Glossary Settings: Manage term associations at the connector level.

  • Others: Configure notification recipients for metadata changes.

• Delete Connector: Remove a connector with confirmation.

For more details on connector settings, click here.

Connectivity Troubleshooting

If incorrect parameters are entered, error messages may appear. Ensure all inputs are accurate to resolve these issues. If issues persist, contact the assigned support team.

S.No.	Error Message(s)	Error Description & Resolution
1	HTTP 401 Unauthorized	Error Description: The NetSuite CRM connector validation fails because the OAuth authentication request is rejected. This issue typically occurs due to an invalid OAuth signature, incorrect API credentials, or an incorrect Realm ID. Resolution: Verify that the Client (Consumer) ID and Client (Consumer) Secret are correct. Ensure that the Token ID and Token Secret are valid and have not expired or been revoked. Confirm that the configured Realm ID matches the NetSuite account ID. Verify that the OAuth credentials use the HMAC-SHA256 signing method supported by the connector. Regenerate the access token if the client secret or token secret has been rotated or updated. Retry the connection after updating the OAuth credentials and Realm ID.
2	HTTP 403 Forbidden	Error Description: The NetSuite CRM connector request is denied because the configured integration role lacks the required permissions to access the requested REST resource. Resolution: Verify that the integration role has the REST Web Services permission enabled. Ensure that the role has SuiteAnalytics Workbook and SuiteQL permissions required for profiling. Confirm that the role has Read access to all record types selected for crawling. Validate that the integration role has separate permissions for both Metadata Catalog and SuiteQL endpoints. Save the updated role permissions and retry the connection or crawl operation.
3	Insufficient permissions to access NetSuite CRM. Minimum SuiteTalk REST permissions are required for connection validation and metadata crawling.	Error Description: The NetSuite CRM connector validation fails because the configured user or integration role lacks the minimum SuiteTalk REST permissions required to validate the connection, retrieve metadata, and perform profiling operations. Resolution: Ensure that the configured NetSuite user or integration role has the required SuiteTalk REST permissions. Grant read access to OPTIONS /services/rest/* for connection validation. Grant read access to GET /services/rest/record/v1/metadata-catalog and GET /services/rest/record/v1/metadata-catalog/{recordType} for metadata crawling. Grant access to the Swagger metadata catalog for custom subrecords, if applicable. Grant access to POST /services/rest/query/v1/suiteql for sample profiling and row count operations. Verify that the assigned role has access to the required record types and metadata. Retry the connection after updating the role permissions.
4	Error while retrieving profiling results: Received HTTP 400 (Bad Request) from the NetSuite CRM SuiteQL API.	Error Description: The profiling operation fails because the SuiteQL query is invalid or the configured role lacks permission to execute SuiteQL queries. This can also occur when profiling unsupported nested object tables or custom subrecords. Resolution: Verify that the configured NetSuite role has the required SuiteQL permissions. Ensure that the table or record name used for profiling is valid and supported by SuiteQL. Avoid profiling nested object tables and custom subrecords; instead, profile the parent record types whenever possible. Review the NetSuite error details logged by the connector to identify the specific cause of the HTTP 400 response. Retry the profiling operation after correcting the table selection or updating the role permissions.

FAQs

What credentials are required for the NetSuite CRM connector?

The NetSuite CRM connector uses OAuth 1.0 Token-Based Authentication (TBA). Configure the connection using the NetSuite Account ID, Client/Consumer ID, Client/Consumer Secret, Token ID, Token Secret, and Realm ID. All six credentials are required. Username, password, server, port, JDBC driver, and connection string fields are not applicable.

What is the difference between the NetSuite Account ID and Realm ID?

The Account ID is used to construct the SuiteTalk REST base URL, while the Realm ID is used as the OAuth realm parameter during authentication. Both values must correspond to the same NetSuite account used to create the integration and access token.

How does Test Connection work?

The Test Connection feature sends an authenticated HTTP OPTIONS request to the NetSuite CRM REST endpoint using OAuth-signed headers. A successful (2xx) response confirms the connection, while a blank or non-2xx response indicates an authentication failure and the connection test fails.

Why does the Test Connection succeed, but crawling returns no tables?

A successful test connection validates only the basic REST service endpoints. Crawling also requires access to the metadata catalog APIs. Ensure the integration role has REST Web Services and metadata catalog read permissions, and verify that Token-Based Authentication (TBA) is enabled for the NetSuite integration record.

What minimum NetSuite permissions are required?

The connector requires read-only SuiteTalk REST permissions, including access to validate the connection, retrieve metadata catalogs, access custom subrecord metadata, and execute SuiteQL queries for sample profiling and row count. No record create, update, or delete permissions are required.

How is the OvalEdge schema mapped?

The connector maps all metadata to a single hardcoded schema named "NetSuite CRM". Multiple databases or schemas are not exposed by the NetSuite CRM connector.

What tables are discovered during crawling?

The crawler discovers standard record types from the metadata catalog, nested object-type properties as separate child tables linked to their parent record types, and custom subrecords as additional tables identified with the NETSUITE_SUBRECORDS short text.

How are columns populated?

Columns are extracted from the metadata catalog schema properties during getRemoteTables() and stored in the globalRemoteTables cache. The getRemoteColumns() method retrieves the columns from this cache. A synthetic relationship column is also added for relationship mapping, using the table name as the column name, the string data type, and the description "Column created to show column relation."

How are relationships built?

Relationships are built by linking parent record types to their nested object tables based on the metadata catalog. Parent-child relationships are derived from the nested object structure, as NetSuite does not provide foreign key metadata.

How does sample profiling work?

The connector supports only Sample Profiling (Profile Type S). Sample data is retrieved using a SuiteQL SELECT * query, while the row count is obtained using a SELECT COUNT(*) query. Auto Profiling, Conditional Profiling, and Query SQL Profiling are not supported.

Is Query Sheet supported?

No. Query Sheet is not supported for this connector. The submitQuery(), getQueryResults(), and getQueryResultsRT() methods return null, and interactive SQL query execution is not available.

Are query logs, views, or procedures supported?

No. Query logs, SQL views, stored procedures, and functions are not supported. The connector does not crawl these objects from NetSuite REST metadata.

Are Auto Lineage, Data Quality, or Data Access supported?

No. Auto Lineage, Data Quality, and Data Access are not supported. These capabilities are disabled by the connector configuration.

How is this connector different from NetSuite CRM JDBC?

The NetSuite CRM connector uses the SuiteTalk REST API with OAuth Token-Based Authentication (TBA) and does not require a JDBC driver. The NetSuite CRM JDBC connector uses JDBC-based connectivity with server, port, and database configuration, and supports SQL-based profiling methods such as Auto, Conditional, Sample, and Query. Use the NetSuite CRM connector for REST-based metadata crawling and the NetSuite CRM JDBC connector for JDBC/SuiteAnalytics connectivity.

---

Copyright © 2026, OvalEdge LLC, Peachtree Corners, GA, USA.