Install the NetSuite components

Install the NetSuite part of Continuous Control with one script from the release zip. It adds the records that hold your Revenue Cloud orders, the revenue engine, and the endpoint Salesforce calls. Plan on 30 to 45 minutes, mostly for one-time login setup.

Check what you need

Administrator access to the NetSuite account.
The required NetSuite features turned on. You don't need any NetSuite revenue feature.
A computer with Node.js 18 or later.
The release zip. The current release is ns-v3.3.1, which works with Salesforce packages 3.3.0, 3.4.0 and 3.4.1. Download continuous-control-netsuite-v3.3.1.zip and unzip it.

Create the installer's login

The installer logs in to NetSuite with a certificate that you create once. This login is only for installing. Salesforce gets its own login in a later section.

In the unzipped release folder, create the certificate and key:

openssl req -new -x509 -newkey rsa:4096 -sha256 -days 730 -nodes \
  -keyout continuous-key.pem -out continuous-cert.pem \
  -subj "/CN=Continuous Control Installer"

Keep continuous-key.pem private. It never leaves your computer.

In NetSuite, go to Setup → Integration → OAuth 2.0 Client Credentials (M2M) Setup → Create New.
For Entity, pick yourself or an integration user.
For Role, pick Administrator or any role with the SuiteCloud Development Framework permission.
For Application, pick SuiteCloud Development Integration.
For Certificate, upload continuous-cert.pem.
Save, and copy the Certificate ID that NetSuite shows.

Run the installer

From the release folder, run:

NS_ACCOUNT=<your account id> \
NS_CERT_ID=<certificate id> \
NS_KEY_PATH=./continuous-key.pem \
./install.sh

The script checks the whole install against your account first. If the check fails, nothing is deployed. A NetSuite feature that isn't turned on is the usual cause. If the check passes, the script asks you to confirm, then deploys.

To run the check without deploying, use ./install.sh --validate-only.

You can run the installer again at any time. It adds and updates components but never deletes them. A re-run or upgrade can't harm your data or settings.

Create the login for Salesforce

Salesforce logs in to NetSuite with Token-Based Authentication. You set this up once, in three parts.

Create the integration record

Go to Setup → Integration → Manage Integrations → New.
Name it Continuous Control.
Check Token-Based Authentication. Leave the TBA authorization flow and user credentials boxes unchecked.
Under OAuth 2.0, uncheck Authorization Code Grant. NetSuite checks it by default, and leaving it on causes an "Invalid Redirect URI" error.
Save. Copy the Consumer Key and Consumer Secret. NetSuite shows them only once.

Assign the integration role

The installer deploys a role named Continuous Control Integration. Assign it to the user Salesforce logs in as.

Go to Setup → Users/Roles → Manage Users, and open the integration user.
On the Access tab, add the Continuous Control Integration role, and save.

Don't edit this role. The installer reapplies it on every upgrade and overwrites any changes you make by hand.

Two things still need an Administrator token instead of the integration role:

A connection whose custom mappings write to vendors, employees, journal entries or other record types outside the role.
The one-time tax setup step, which creates tax agencies and nexuses.

Otherwise, the role covers every transaction type an order or a custom mapping can target: sales orders, estimates, invoices, credit memos, cash sales and return authorizations. The full permission list is in the reference version of this page.

Create the access token

Go to Setup → Users/Roles → Access Tokens → New.
Pick the integration, the integration user and the role.
Save. Copy the Token ID and Token Secret. NetSuite shows them only once.

Give the four values and your account id to whoever runs the Connection wizard. They enter them once, in step 1.

Move an existing connection to the new role

A connection already running on Administrator or another role keeps working. Move it to the integration role when you're ready:

Assign the Continuous Control Integration role to the integration user, as above.
Go to Setup → Users/Roles → Access Tokens → New, and create a token for that user and role.
In Salesforce, open wizard step 1 and enter the new Token ID and Token Secret. The consumer key and consumer secret stay the same.

Wizard step 4 shows a note when a connection isn't on the integration role or Administrator yet.

Know the endpoint Salesforce calls

The installer creates the script Salesforce calls, named Continuous Control (RESTlet). Its script id is customscript_cc_control_rl, and its deployment is customdeploy_cc_control_rl.

You don't need to enter these anywhere. Leave the two RESTlet fields blank in the Connection wizard, and it uses them. Fill the fields in only if your NetSuite team renamed the deployment.

Salesforce also calls two more scripts directly after a sync: the Update POBs and Update Revenue Plans Suitelets that run the revenue engine. See The engine Suitelets.

Upgrade to a new release

Run ./install.sh from the newer release zip. It checks, asks you to confirm, and deploys, the same as the first time.

Then open wizard step 4 in Salesforce. Click Run post-install setup, then Verify installation.

Next steps

Finish the NetSuite manual setup.
Run the Connection wizard in Salesforce.