Does Oracle NetSuite have native webhooks for invoices?

Yes. NetSuite Event Subscriptions push webhook notifications when invoices are created, edited, or deleted. However, NetSuite webhooks do not include HMAC signatures by default; instead they rely on IP allowlisting and a shared secret embedded in the callback URL. ml-connector validates every inbound webhook using HMAC-SHA1 and matches it to the correct customer account before sending Twilio messages.

What happens when an Oracle NetSuite OAuth token expires?

NetSuite M2M OAuth tokens expire after 60 minutes with no refresh token in the flow. ml-connector proactively refreshes the token before expiry by monitoring elapsed time and requesting a new token when 50 minutes have passed, so calls never fail due to token age. If a token does expire during a call, the request returns 401 and ml-connector immediately fetches a fresh token and retries.

How does ml-connector match inbound Twilio messages back to NetSuite invoices?

Inbound SMS and voicemail transcripts arrive as Twilio webhooks with the sender phone number and message body. ml-connector looks up the phone number in NetSuite customer records to find the matching customer, then searches for open invoices on that customer and matches by amount or description. The message is then logged as a note or custom record on the invoice with a timestamp and full Twilio metadata for audit purposes.

Oracle NetSuiteTwilio

Oracle NetSuite and Twilio integration

Oracle NetSuite runs your orders, invoices, and customers. Twilio handles SMS, voice, and email at scale. Connecting them notifies customers when invoices are due, confirms payments received, and logs inbound customer calls and texts directly into NetSuite. Your AR team stays in sync with customer communication without re-entering data by hand, and payment reminders are triggered automatically on a schedule you define.

How Oracle NetSuite works

Oracle NetSuite exposes invoices, customers, vendors, sales orders, purchase orders, payments, and GL accounts through the SuiteTalk REST API authenticated with OAuth 2.0 client credentials, which requires a certificate for M2M integration. NetSuite tokens expire after 60 minutes and cannot be refreshed in the M2M flow, so each call must complete within that window. NetSuite supports push webhooks for Invoice, Customer, Sales Order, and Inventory Item events, though webhooks have no native HMAC signature validation and instead rely on IP allowlisting or a shared secret embedded in the URL. Alternatively, ml-connector can poll SuiteQL to read invoices, customers, and payment history on a daily or weekly cadence.

How Twilio works

Twilio exposes messaging, voice calls, and identity verification through multiple REST APIs, each with its own base URL and authenticated with HTTP Basic Auth using either Account SID plus Auth Token or an API Key SID plus API Secret. Twilio sends real-time push webhooks for inbound messages, message delivery status (sent, delivered, failed, read), inbound calls, call status callbacks (ringing, answered, completed, failed), and recording completion. Webhook signatures are validated with HMAC-SHA1 using the Auth Token as the key. Twilio is a communications platform and does not store invoices, GL accounts, customers, or payments; it can only send and receive messages tied to phone numbers.

What moves between them

Invoices created or updated in Oracle NetSuite trigger a flow that sends an SMS or email notification to the customer phone number or email on file via Twilio. When a payment date is approaching, a scheduled flow pulls upcoming invoices from NetSuite daily and sends payment reminders via Twilio SMS. Inbound customer replies to Twilio SMS or voicemail transcripts from Twilio voice calls are logged back into NetSuite as custom transaction records or notes on the matching invoice, preserving the full communication history. Reference data such as customer phone numbers and preferred contact method are read from NetSuite customer records and updated by customer service teams in NetSuite; Twilio holds no customer master.

How ml-connector handles it

ml-connector stores Twilio API Key credentials encrypted and presents them on every HTTP Basic Auth call to Twilio. On the NetSuite side, it maintains an OAuth 2.0 token cache and refreshes it proactively before the 60-minute expiry window, so calls do not fail due to token age. NetSuite webhooks require IP allowlisting and a shared secret in the callback URL, which ml-connector validates using HMAC-SHA1 on every inbound event. Twilio webhooks are validated using HMAC-SHA1 with Twilio's Auth Token as the key. For polling, ml-connector runs a scheduled job that queries NetSuite for invoices due within the next 7 days and sends SMS reminders via Twilio to phone numbers stored in the customer record. Inbound Twilio messages arrive as webhooks and are matched to a NetSuite invoice by customer name and invoice amount, then stored as a custom transaction record. Because Twilio does not have exactly-once delivery, ml-connector deduplicates messages using the Twilio Message SID as the unique key.

A real-world example

A mid-market SaaS company with 200+ enterprise customers invoices monthly through Oracle NetSuite and needs to improve AR cash flow without hiring more collection staff. Customer service reps currently send payment reminders via email; response rates are low and follow-up takes days. By connecting NetSuite and Twilio, the company sends SMS reminders 5 days before each invoice is due, and logs replies into NetSuite so all communication is visible in the invoice. Some customers text back questions or objections, which the AR team now sees immediately instead of in a separate email thread, and payment confirmations arrive as SMS replies that are timestamped in NetSuite for reconciliation. Month-end AR reporting now includes the communication history, and renewal conversations start with concrete data on customer payment patterns.

What you can do

Send SMS and email notifications from Twilio when NetSuite invoices are created, updated, or approaching their due date.
Log inbound SMS replies and voice call transcripts from Twilio back into Oracle NetSuite as transaction notes or custom records tied to the original invoice.
Store Twilio and NetSuite credentials encrypted, validate webhook signatures with HMAC-SHA1, and refresh OAuth tokens every 60 minutes.
Map customer phone numbers and email addresses from NetSuite customer records to Twilio message endpoints, with no separate customer database required.
Deduplicate inbound messages using Twilio Message SID, with a full audit trail on every notification sent and reply received.

Questions

Does Oracle NetSuite have native webhooks for invoices?: Yes. NetSuite Event Subscriptions push webhook notifications when invoices are created, edited, or deleted. However, NetSuite webhooks do not include HMAC signatures by default; instead they rely on IP allowlisting and a shared secret embedded in the callback URL. ml-connector validates every inbound webhook using HMAC-SHA1 and matches it to the correct customer account before sending Twilio messages.
What happens when an Oracle NetSuite OAuth token expires?: NetSuite M2M OAuth tokens expire after 60 minutes with no refresh token in the flow. ml-connector proactively refreshes the token before expiry by monitoring elapsed time and requesting a new token when 50 minutes have passed, so calls never fail due to token age. If a token does expire during a call, the request returns 401 and ml-connector immediately fetches a fresh token and retries.
How does ml-connector match inbound Twilio messages back to NetSuite invoices?: Inbound SMS and voicemail transcripts arrive as Twilio webhooks with the sender phone number and message body. ml-connector looks up the phone number in NetSuite customer records to find the matching customer, then searches for open invoices on that customer and matches by amount or description. The message is then logged as a note or custom record on the invoice with a timestamp and full Twilio metadata for audit purposes.

Connect Oracle NetSuite and Twilio

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started