Skip to Content
Guardian Expense

Help · NetSuite

Connect NetSuite to Guardian Expense

A step-by-step guide for your NetSuite administrator. It takes about 20 minutes: steps 1–6 happen in NetSuite, step 7 in Guardian Expense. If you have a NetSuite sandbox, connect it first and switch to production once a test report has exported.

Before you start

  • A NetSuite login with the Administrator role. Only an administrator can turn on features, create roles and integrations, and upload certificates.
  • The certificate file from Guardian Expense. A Guardian Expense corporate admin downloads it from Admin › NetSuite › Connection › Connect to NetSuite › Create Certificate. It holds only the public half of the key, so it's safe to email. The private half never leaves Guardian Expense.
  • Somewhere to note three values you'll need in step 7:
Account ID
Step 1 · 1234567 or 1234567_SB1
Client ID
Step 5 (shown once) · 64 letters and digits
Certificate ID
Step 6 · a long code

Step 1: Find your account ID

Go toSetup › Company › Company Information

Copy the Account ID. It's also the first part of the address in your browser: https://1234567.app.netsuite.com.

A sandbox ID ends in _SB1 (or _SB2 …). Enter it exactly as shown, including the suffix.

Step 2: Turn on the features Guardian uses

Go toSetup › Company › Enable Features

  1. Employees subtab: check Expense Reports.
  2. SuiteCloud subtab, SuiteTalk (Web Services) section: check REST Web Services.
  3. SuiteCloud subtab, Manage Authentication section: check OAuth 2.0.
  4. Click Save, and accept the terms if NetSuite asks.

Token-Based Authentication isn't needed. NetSuite is retiring it for new integrations, and Guardian Expense uses OAuth 2.0.

Step 3: Create the Guardian role

Go toSetup › Users/Roles › Manage Roles › New

  1. Name: Guardian Expense Integration
  2. Subsidiary restrictions (OneWorld accounts): choose All, so Guardian Expense can file expense reports for every operating company's subsidiary.
  3. On the Permissions subtab, add each permission below on its subtab (choose it, set the level, click Add), then Save.
Permissions for the Guardian Expense Integration role
SubtabPermissionLevel
TransactionsExpense ReportEdit
TransactionsFind TransactionView
ReportsSuiteAnalytics WorkbookEdit
ListsEmployeesView
ListsSubsidiariesView
ListsExpense CategoriesView
ListsDepartmentsView
ListsClassesView
ListsLocationsView
ListsCurrencyView
SetupLog in using OAuth 2.0 Access TokensFull
SetupREST Web ServicesFull

If your account uses Advanced Employee Permissions, the Lists subtab shows Employee Record and Employee Public instead of Employees. Add both at View.

Don't add OAuth 2.0 Authorized Applications Management to this role, and don't use the Administrator role for the connection. NetSuite won't let a role with that permission sign in with OAuth 2.0.

Step 4: Give the role to an employee

Go toLists › Employees › Employees

Guardian Expense works in NetSuite as this employee. Use a dedicated record, for example Guardian Integration with a shared finance mailbox, so the connection keeps working when someone leaves.

  1. Open the employee and click Edit.
  2. Access subtab: check Give Access if it isn't already.
  3. In Roles, add Guardian Expense Integration, then Save.

If NetSuite asks for a password, set a long random one. Guardian Expense never uses it.

Step 5: Create the integration record

Go toSetup › Integration › Manage Integrations › New

  1. Name: Guardian Expense · State: Enabled
  2. Authentication subtab, Token-based Authentication: leave Token-Based Authentication and TBA: Authorization Flow unchecked.
  3. OAuth 2.0: check Client Credentials (Machine to Machine) Grant. Leave Authorization Code Grant and Public Client unchecked.
  4. Scope: check REST Web Services.
  5. Click Save.

The confirmation page shows the Client ID once. Copy it now. Guardian Expense doesn't need the Client Secret. If you lose the Client ID, open the integration, click Reset Credentials and copy the new one.

Step 6: Upload Guardian's certificate

Go toSetup › Integration › Manage Authentication › OAuth 2.0 Client Credentials (M2M) Setup › Create New

  1. Entity: the employee from step 4.
  2. Role: Guardian Expense Integration.
  3. Application: Guardian Expense. It's listed only when step 5's Client Credentials box is checked.
  4. Certificate: choose the .pem file from Guardian Expense.
  5. Click Save. Find the new row in the list and copy its Certificate ID.

The employee from step 4 is listed only after they have the role and access. Each certificate works for one employee, role and application.

Step 7: Connect in Guardian

Go toGuardian Expense › Admin › NetSuite

A Guardian Expense corporate admin finishes the connection:

  1. Connection tab: Provider NetSuite (REST), Environment Sandbox or Production, the Account ID from step 1. Click Save.
  2. Connect to NetSuite: paste the Client ID (step 5) and the Certificate ID (step 6), then click Connect.
  3. Click Validate Connection. Fix anything it lists, using the troubleshooting table below.
  4. Mappings tab: click Refresh from NetSuite, then map each operating company to its subsidiary, and people, categories and any departments, classes or locations.
  5. Approve a test report and check that it appears in NetSuite under Transactions › Employees › Expense Reports.

Keeping it running

  • Renew the certificate every two years. Two years is NetSuite's maximum. Guardian Expense shows the expiry date and warns 30 days ahead. To renew, click Create New Certificate in Guardian Expense, repeat step 6 with the new file (same employee, role and application), and connect the new Certificate ID. The old certificate keeps working until then. Afterwards, click Revoke on its row in NetSuite.
  • Sandbox refreshes clear step 6. NetSuite removes the certificate setup when a sandbox is refreshed. Repeat steps 5–7 afterwards.
  • Sandbox and production are set up separately. When you move to production, repeat steps 1–7 there with a new certificate.
  • Keep the employee active. If the step 4 employee is made inactive or loses the role, exports stop until it's fixed.

Troubleshooting

Common problems and what to check
What you seeWhat to check
Validation: “NetSuite rejected the client credentials”The Client ID and Certificate ID (Guardian Expense shows the last four characters of each); the integration is Enabled with Client Credentials checked; the step 6 row isn't revoked or expired; the Account ID suffix (_SB1) matches the account.
Validation: “Could not read the expenseReport metadata”Expense Reports is on (step 2) and the role has Expense Report and REST Web Services (step 3).
Refresh from NetSuite: “Couldn't load …”The role is missing SuiteAnalytics Workbook or that list's permission (step 3). The other lists still load.
A list loads but is empty or shortNetSuite hides rows the role can't see. Check the list's permission and the role's subsidiary restrictions.
Step 6: the employee or application isn't listedThe employee needs Give Access and the role (step 4). The integration needs Client Credentials (Machine to Machine) Grant and State Enabled (step 5).
An export fails with a subsidiary errorThe person's NetSuite employee record must be in the subsidiary their operating company maps to. Validate Connection lists anyone who doesn't match.

What Guardian Expense can do in NetSuite

Only what the role in step 3 allows: create expense reports for approved reports, and read the lists used for mapping. It can't edit or delete existing records. The private key is stored in a managed secret store for your company and is never shown to anyone. To cut access at any time, click Revoke on the certificate in step 6, or set the integration to Blocked.

Stuck? Email sales@guardianexpense.com and say which step you're on.