How do I connect NetSuite to Leapsome?
Admins can connect NetSuite in Settings > Integrations > NetSuite by entering their Account ID, Client ID, Certificate ID, and private key. The setup requires creating an integration record, a dedicated role, and a certificate in NetSuite first.
Leapsome acts as the source of truth: when someone joins, changes role, moves department, or leaves in Leapsome, the matching NetSuite employee record is created, updated, or set to inactive. Data only flows from Leapsome to NetSuite, nothing syncs back.
What do I need before setting up the integration?
- A Leapsome admin with the 'Manage integrations' permission
- A NetSuite administrator to complete the NetSuite-side setup
- In NetSuite: the REST Web Services and OAuth 2.0 features enabled (Setup > Company > Enable Features > SuiteCloud)
How to set up the NetSuite integration
Step 1: Create an integration record in NetSuite
- Go to Setup > Integration > Manage Integrations > New.
- Give the record a name, for example 'Leapsome'.
- Under 'Authentication', tick Client Credentials (Machine to Machine) Grant and tick the REST Web Services scope.
- Click 'Save'. NetSuite shows the Client ID once. Copy it now; you can't view it again.
If the REST Web Services scope is not ticked, NetSuite will issue a token but reject every request with ScopeMismatched.
Step 2: Create a role for the integration
Create a dedicated role, for example 'Leapsome Integration', and assign it the following permissions:
Setup
- REST Web Services (Full)
- Log in using OAuth 2.0 Access Tokens (Full)
Lists
- Employees (Full)
- Employee Record (Full)
- Perform Search (Full)
- Departments (View)
- Subsidiaries (View)
Optional
- Employee Social Security Numbers (Full). Only needed if you plan to map Social Security numbers. Without it, NetSuite silently ignores that field.
Under 'Subsidiary Restrictions', make sure the role can access every subsidiary you want to create employees in.
Step 3: Assign the role to a service account
Choose or create an employee record that will act as the service account. On its 'Access' tab, tick Give Access and add the role from Step 2. This is the identity Leapsome acts as when syncing data.
Step 4: Create a certificate and private key
Leapsome authenticates with a certificate rather than a password. Generate the key pair on a secure machine:
openssl req -x509 -newkey rsa:3072 -keyout leapsome-netsuite-key.pem -out leapsome-netsuite-cert.pem -days 730 -nodes -subj "/CN=Leapsome"
This produces two files:
- Certificate (
leapsome-netsuite-cert.pem) — uploaded to NetSuite - Private key (
leapsome-netsuite-key.pem) — pasted into Leapsome only; must never be shared elsewhere
The key must be RSA with at least 3072 bits. NetSuite rejects shorter keys.
Step 5: Map the certificate in NetSuite
- Go to Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials (M2M) Setup.
- Click 'Create New'.
- Select the service account from Step 3 as the 'Entity', the role from Step 2, and the integration record from Step 1 as the 'Application'.
- Upload the certificate file.
- Click 'Save'. The table now shows a Certificate ID. Copy it.
Step 6: Allocate concurrency (recommended)
Go to Setup > Integration > Integration Management > Integration Governance and allocate at least 2 concurrent requests to the Leapsome integration. Without a dedicated allocation, Leapsome shares the account pool with your other integrations and may receive CONCURRENCY_LIMIT_EXCEEDED errors during a full sync.
Step 7: Connect in Leapsome
- In Leapsome, go to Settings > Integrations and imports > HRIS integrations > Outbound Provisioning and open NetSuite.
- Enter your Account ID. For sandboxes, include the suffix, for example
1234567_SB1. - Enter the Client ID from Step 1 and the Certificate ID from Step 5.
- Paste the full contents of the private key file, including the
-----BEGINand-----ENDlines. - Click 'Authorize'.
Leapsome immediately requests a token and reads one employee record to verify the connection. If either step fails, the error includes NetSuite's own reason, for example HTTP 401, INVALID_LOGIN. See the Troubleshooting section below.
Step 8: Configure what syncs
Activation and deactivation
- Automatically create employees in NetSuite. When enabled, Leapsome creates a NetSuite employee for anyone it cannot match. First name, last name, email, and a mapped subsidiary are required. When disabled, only employees that already exist in NetSuite are updated.
- Deactivate employees in NetSuite when they are deactivated in Leapsome — when enabled, deactivating someone in Leapsome sets the matching NetSuite employee to inactive and writes the release date. Records are never deleted.
Map subsidiaries
NetSuite requires a subsidiary to create an employee. Map each Leapsome legal entity to a NetSuite subsidiary. Employees whose legal entity is not mapped are skipped and listed after each sync.
Map attributes
First name, last name, email, and subsidiary are always synced. All other mappings can be switched on or off individually. Birth date, legal gender, and social security number are off by default and must be enabled deliberately.
Department is matched by name: the employee's Leapsome department must match the name of an active NetSuite department exactly (case does not matter). Employees with no department, multiple departments, or a department name NetSuite does not recognize keep their current NetSuite department.
You can also add rows for custom Leapsome attributes and map them to standard NetSuite fields. Each NetSuite field can only be mapped once.
How does the sync run?
Full sync
Click 'Sync now'. Leapsome saves your current settings, then processes every active and deactivated employee. Large teams can take several hours because NetSuite limits request rates. Progress is shown on the page, and the run continues in the background if you close it.
Automatic updates
Whenever a mapped attribute changes on a Leapsome profile, or an employee is deactivated, Leapsome updates the corresponding NetSuite employee within a few minutes. No manual sync is needed.
How matching works
For each employee, Leapsome first looks for the NetSuite record it linked previously. If there is none, it searches by work email, then by employee ID against NetSuite's external ID. Based on the result:
- One match found: the record is updated and linked.
- No match found, auto-create enabled: a new NetSuite employee is created.
- Multiple matches found: the employee is skipped and reported. Merge the duplicate records in NetSuite and run the sync again.
Troubleshooting
1. HTTP 401, INVALID_LOGIN when connecting
Check that the role from Step 2 has both Setup permissions, and that the integration record has the REST Web Services scope ticked. NetSuite's Login Audit Trail (Setup > Users/Roles > User Management > View Login Audit Trail, with the 'Detail' column visible) shows the exact reason, for example ScopeMismatched.
2. Employees skipped because required fields are missing
The sync lists which fields are missing for each person. Fill them in on the Leapsome profile and run the sync again.
3. Employees skipped because their legal entity is not mapped
Map the missing legal entity under 'Map subsidiaries' in the NetSuite integration settings.
4. Several NetSuite employees share this user's email address
Two or more NetSuite records have the same email or external ID. Merge or correct them in NetSuite, then run the sync again.
5. HTTP 400, USER_ERROR with a NetSuite message
NetSuite rejected the employee record. The error message names the field — for example, a mandatory field on a custom employee form that Leapsome does not fill. Either set a default value in NetSuite or map the field in Leapsome.
6. HTTP 429, CONCURRENCY_LIMIT_EXCEEDED
The integration exceeded NetSuite's concurrency allowance. Allocate dedicated concurrency to the Leapsome integration record as described in Step 6, then run the sync again.
7. Social security numbers do not appear in NetSuite
The role needs the 'Employee Social Security Numbers' permission. NetSuite drops the field silently without it.
How do I disconnect the NetSuite integration?
Click 'Revoke authorization' in the NetSuite integration settings. Leapsome deletes the stored credentials and stops all syncing. Existing NetSuite records are left untouched.
To stop the integration on the NetSuite side as well, delete the certificate mapping from Step 5 or deactivate the integration record in NetSuite.
Security notes
The private key is encrypted before it is stored and is never shown again after connecting. Leapsome only writes employee records; it does not read or change anything else in NetSuite. Personal data such as birth date, gender, and Social Security number is only sent when an admin has explicitly enabled the mapping.