Which direction does data move between oracle NetSuite and Gusto?

The main flow is Gusto into oracle NetSuite. Payroll labor totals and employee records move from Gusto into oracle NetSuite so the GL and employee master stay current. oracle NetSuite does not write payroll data back to Gusto; the connection is read-only on Gusto.

How does ml-connector handle the different OAuth2 flows on each side?

Gusto uses OAuth2 Authorization Code flow with a 2-hour access token and a rotating single-use refresh token. oracle NetSuite uses OAuth2 M2M with a certificate and a 60-minute token lifetime. ml-connector stores both credential sets encrypted, caches the Gusto token and refreshes on 401, and requests a new oracle NetSuite token on startup or when needed.

How are Gusto payroll costs mapped to oracle NetSuite GL accounts and cost centers?

The mapping is manual and static. You configure which Gusto payroll cost categories and which Gusto company locations map to which oracle NetSuite GL accounts and cost centers. Gusto does not expose GL accounts or accounting dimensions, so the mapping cannot be automated; when Gusto cost centers or company structure changes, the mapping must be updated to match.

Oracle NetSuiteGusto

Oracle NetSuite and Gusto integration

Oracle NetSuite runs your financials and general ledger; Gusto runs payroll and HR. Connecting the two keeps your labor accounts and employee records in agreement, with labor cost totals flowing into Oracle NetSuite's general ledger on a schedule you control. Each payroll run posts to the correct accounts and departments, and new hires, terminations, and rehires in Gusto update your employee master in Oracle NetSuite immediately. ml-connector handles the two very different OAuth2 flows seamlessly.

How Oracle NetSuite works

Oracle NetSuite exposes vendors, purchases, invoices, accounts, employees, departments, and payroll GL records through SuiteTalk REST API, with endpoints at https://<accountId>.suitetalk.api.netsuite.com. Authentication uses OAuth2 Client Credentials M2M with a certificate. Records can be created or updated via REST, or read in bulk through SuiteQL queries. Oracle NetSuite offers Event Subscriptions as webhooks for record create and edit events, but provides no HMAC signature; instead it requires IP allowlist and a shared secret in the URL. Older implementations may use Token-Based Authentication, but this is deprecated after 2026. Polling via SuiteQL remains the safest path for bulk or historical reads.

How Gusto works

Gusto exposes employees, compensations, payroll runs, contractors, company benefits, and bank accounts through REST at https://api.gusto.com with OAuth2 Authorization Code flow. Each OAuth token is scoped to a single company, with an access token lifetime of 2 hours and a refresh token that never expires but rotates on use. Gusto provides webhooks for payroll events (created, updated, calculated, processed, paid, reversed), employee events (created, updated, onboarded, terminated), and company events; every webhook call must return 2xx within 10 seconds, and Gusto retries up to 16 times over 3 days. Dollar amounts come back as string decimals, not numbers. Gusto does not expose GL accounts, vendor records, or native accounting dimensions, so payroll GL lines cannot be directly keyed to Gusto objects.

What moves between them

The main flow is Gusto into Oracle NetSuite. After each payroll run, ml-connector reads the Gusto payroll event and extracts total labor costs, then posts a summary GL entry into Oracle NetSuite's general ledger, mapped to the cost center and GL account for that payroll. Employee records flow from Gusto into Oracle NetSuite so the employee master stays current with hires, terminations, and rehires. Compensation details from Gusto can also drive the employee record in Oracle NetSuite. The direction is unidirectional into Oracle NetSuite; oracle NetSuite does not write payroll or compensation back to Gusto.

How ml-connector handles it

ml-connector stores both Gusto and Oracle NetSuite OAuth2 credentials encrypted. Gusto tokens expire in 2 hours and have a rotating single-use refresh token, so ml-connector caches the current token and refreshes on 401 response, then retries the original call. Oracle NetSuite uses M2M OAuth2 with a 60-minute token lifetime and no refresh token, so ml-connector obtains a new certificate-signed token on each session startup or when a call returns 401. Gusto rate limits at 200 requests per minute per token, so ml-connector tracks request count and backs off if approaching the limit. Gusto payroll events arrive as webhooks; ml-connector verifies the HMAC-SHA256 signature against the subscription verification token. Gusto returns dollar amounts as string decimals, so ml-connector parses them carefully and rounds only at the Oracle NetSuite posting. Cost centers and GL accounts are mapped manually upfront so every payroll posting lands on a valid oracle NetSuite dimension. Because Gusto does not expose GL accounts or accounting dimensions, the mapping is static and human-maintained; changes to company cost centers must be reflected in the mapping configuration.

A real-world example

A mid-sized services firm with 80 employees runs oracle NetSuite for accounting and payroll and Gusto for HR and benefits. The finance team previously ran Gusto payroll, exported the labor cost register, and manually keyed weekly labor totals into oracle NetSuite by department, then spent month-end close reconciling employee headcount in Gusto against the labor accounts in oracle NetSuite. With Gusto and oracle NetSuite connected, each payroll run posts labor costs automatically to the correct GL accounts and cost centers, and employee changes keep the two systems aligned. Month-end close now starts with labor accounts already balanced and headcount verified, cutting a full day of manual rework.

What you can do

Post Gusto payroll labor costs into oracle NetSuite's general ledger after every pay run, allocated to the correct cost centers and GL accounts.
Keep oracle NetSuite employee records synchronized with Gusto hires, terminations, and rehires.
Map Gusto compensation and payroll dimensions to oracle NetSuite GL accounts so every entry lands on a valid account.
Authenticate oracle NetSuite with OAuth2 M2M certificates and refresh Gusto's per-company tokens automatically on expiry.
Handle Gusto webhooks with HMAC signature verification, tolerate rate limits, and maintain a full audit trail on every record.

Questions

Which direction does data move between oracle NetSuite and Gusto?: The main flow is Gusto into oracle NetSuite. Payroll labor totals and employee records move from Gusto into oracle NetSuite so the GL and employee master stay current. oracle NetSuite does not write payroll data back to Gusto; the connection is read-only on Gusto.
How does ml-connector handle the different OAuth2 flows on each side?: Gusto uses OAuth2 Authorization Code flow with a 2-hour access token and a rotating single-use refresh token. oracle NetSuite uses OAuth2 M2M with a certificate and a 60-minute token lifetime. ml-connector stores both credential sets encrypted, caches the Gusto token and refreshes on 401, and requests a new oracle NetSuite token on startup or when needed.
How are Gusto payroll costs mapped to oracle NetSuite GL accounts and cost centers?: The mapping is manual and static. You configure which Gusto payroll cost categories and which Gusto company locations map to which oracle NetSuite GL accounts and cost centers. Gusto does not expose GL accounts or accounting dimensions, so the mapping cannot be automated; when Gusto cost centers or company structure changes, the mapping must be updated to match.

Connect Oracle NetSuite and Gusto

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started