# NetSuite setup checklist for the Connect lookup

Companion to [Amazon Connect + NetSuite](/blog/amazon-connect-netsuite-integration-2026/). Checklist only; no code. The adapter is in [`../erp/`](../erp/README.md).
Source for every "Oracle" line: Oracle NetSuite help pages listed at the end of the post. Items marked UNVERIFIED were not confirmed on an Oracle page.

## Per account (repeat for sandbox and production; Oracle says setup is not copied and a sandbox refresh clears it)

- [ ] Features enabled: REST Web Services and OAuth 2.0 (UNVERIFIED checkbox names).
- [ ] Integration record: State Enabled; OAuth 2.0 Client Credentials (Machine to Machine) Grant checked; REST Web Services scope checked. Save client ID now (shown once).
- [ ] Role: dedicated, view-only on Customer, Invoice, Sales Order (UNVERIFIED exact permission names; third-party guides add REST Web Services and "Log in using OAuth 2.0 Access Tokens").
- [ ] Entity assigned to that role.
- [ ] Certificate: RSA 3072/4096 or EC 256/384/521, x.509, `.cer`/`.pem`/`.crt`, validity at most 2 years. Private key into Secrets Manager only.
- [ ] Mapping: Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials (M2M) Setup > Create New (entity, role, application, public certificate). Record the Certificate ID (JWT `kid`).
- [ ] At most 5 active certificates per integration record + entity + role. Rotate by adding the new one first.
- [ ] Calendar entry for certificate expiry (Oracle emails at 2 months, 1 month, 14 days).
- [ ] Concurrency: ask the account owner for the account limit and other users of it; set Lambda reserved concurrency below the agreed share.

## Verify before go-live

- [ ] `curl` token request returns `access_token` and `expires_in` 3600.
- [ ] One SuiteQL call with `Prefer: transient` returns an `items` array.
- [ ] Open-invoice status code (`CustInvc` status `A`) and `isInactive` value confirmed in your account.
- [ ] Phone key decided: normalized custom field, or another identifier.
- [ ] `node --test` passes in `../erp/`. All HTTP there is mocked; nothing here has run against a live NetSuite account.