Oracle NetSuite and Cin7 integration

What moves between them

The main flow runs from NetSuite into Cin7. Vendor records and purchase orders created or updated in NetSuite are read via SuiteQL polling and pushed into Cin7 as supplier and purchase records. When vendor bills are received in NetSuite, the invoice lines are read and posted into Cin7's chart of accounts GL entries, mapped to the matching Cin7 GL account codes. Purchases in Cin7 are tracked through their Approach lifecycle (ORDER, INVOICE, RECEIVE), and ml-connector advances them through state transitions as NetSuite records change.

How ml-connector handles it

ml-connector stores both credential sets encrypted: NetSuite's OAuth2 certificate and client ID on the left, Cin7's API keys on the right. NetSuite OAuth tokens expire at 60 minutes, so ml-connector refreshes them before expiry and handles 401 responses by re-authenticating. On the Cin7 side, API key headers are sent on every request with no expiry tracking needed. Because NetSuite publishes no HMAC signatures on Event Subscriptions, ml-connector validates subscription payloads using an IP allowlist or a shared secret in the URL query string rather than a signed header. If NetSuite subscriptions are not configured, ml-connector polls SuiteQL on a fixed schedule to catch vendor, PO, and bill changes. GL accounts are mapped first: Cin7's read-only chart of accounts is fetched once per flow run, and invoice lines are matched to accounts by code or display name before posting. Because Cin7's Approach field tracks purchase state explicitly, ml-connector advances purchases through ORDER, INVOICE, and RECEIVE stages in step with NetSuite vendor bill lifecycle.

A real-world example

A mid-sized distributor runs Oracle NetSuite for financial operations and procurement, and recently deployed Cin7 to manage warehouse inventory and purchase order fulfillment. Before the integration, the procurement team created purchase orders in NetSuite, then manually re-entered the same PO data into Cin7, and when invoices were received from vendors, the AP clerk updated the bill status in NetSuite and posted the invoice lines to the GL by hand while also checking them against the Cin7 purchase record to confirm the GL account coding. With NetSuite and Cin7 connected, new vendors and POs flow directly from NetSuite into Cin7 on creation, purchase state advances automatically as bills arrive, and invoice GL postings are mapped and balanced against Cin7's chart of accounts in a single synchronized step. The duplicate data entry is gone, and the GL balance is always reconciled to Cin7 inventory.

What you can do

• •Sync vendors and purchase orders from Oracle NetSuite to Cin7, keeping suppliers and procurements aligned across systems.
• •Post vendor bill GL entries from NetSuite into Cin7's chart of accounts, mapped to matching GL account codes.
• •Advance purchases through Cin7's ORDER, INVOICE, and RECEIVE lifecycle as vendor bills are received in NetSuite.
• •Bridge OAuth 2.0 and API key authentication, handling 60-minute token expiry and API key header injection.
• •Poll SuiteQL and validate unsigned Event Subscriptions with IP allowlist or query-parameter shared secret.

Questions

What is the main direction of data flow between Oracle NetSuite and Cin7?

The main flow is NetSuite into Cin7. Vendor records and purchase orders created in NetSuite are synced to Cin7 as suppliers and purchases. Vendor bill GL entries from NetSuite post into Cin7's chart of accounts. Cin7's purchase state is advanced through ORDER, INVOICE, and RECEIVE stages as vendor bills change in NetSuite.

How does ml-connector handle the different authentication schemes on each side?

Oracle NetSuite uses OAuth 2.0 with a certificate, while Cin7 uses custom API key headers (api-auth-accountid and api-auth-applicationkey). ml-connector stores both credential sets encrypted, refreshes NetSuite OAuth tokens before their 60-minute expiry, and injects Cin7 API key headers on every request. No refresh token is needed on the NetSuite M2M flow.

How are Event Subscriptions validated if NetSuite does not include HMAC signatures?

ml-connector validates unsigned Event Subscriptions from NetSuite using an IP allowlist, a shared secret in the webhook URL query string, or both, rather than a signed header. If subscriptions are not configured, ml-connector polls SuiteQL on a fixed schedule to catch changes to vendors, purchase orders, and vendor bills.