How-toOracle NetSuiteSetup / Integration / Access Tokens

NetSuite Delete Integration: How to Remove an Integration Record and Its Token Access Safely

Question
netsuite delete integration

Also searched as

  • how to delete an integration record in netsuite
  • netsuite disable integration token
  • netsuite revoke access token integration
  • netsuite block integration application

Short answer

In NetSuite an integration record is the application identity (consumer key and secret) behind token-based authentication and OAuth. The safe order is: find what still uses it, set its State to Blocked, revoke the access tokens issued against it, watch for failures, and only then delete it if NetSuite allows deletion. Blocking is reversible, deleting is not.

Applies to: All current NetSuite releases with token-based authentication (TBA) and OAuth 2.0. Menu labels move slightly between releases; the Manage Integrations and Access Tokens lists are the stable entry points.

How to remove a NetSuite integration safely

  1. 1Go to Setup > Integration > Manage Integrations and open the integration record. Note its Name, Application ID, who created it and the Token-Based Authentication and OAuth 2.0 checkboxes. This tells you which authentication type to clean up.
  2. 2Find the users of the integration. Open Setup > Users/Roles > Access Tokens (the list may also appear as Manage Access Tokens) and filter by Application Name. Each row is a user and role pair holding a token for that integration.
  3. 3Check recent activity before touching anything. Use Setup > Integration > Web Services Usage Log, the Script Execution Log for RESTlets, and the Login Audit Trail (Setup > Users/Roles > User Management > View Login Audit Trail) to see whether the integration authenticated in the last 30 to 90 days.
  4. 4Tell the owner of the external system (iPaaS, WMS, EDI, BI tool, custom script). Ask them to switch to a new integration record or confirm the connection is retired.
  5. 5Set State to Blocked on the integration record and save. NetSuite stops accepting requests signed by that consumer key. This is the reversible way to test whether anything still depends on it.
  6. 6Revoke the individual access tokens in the Access Tokens list (open a token and revoke it, or use the Revoke action). Revoked tokens cannot be reactivated; a new token must be issued.
  7. 7Wait one full business cycle, including month end and any weekly batch, and watch the logs for failed authentication from the old application.
  8. 8If the record is no longer needed, use Edit > Delete on the integration record. If NetSuite refuses because of dependencies, leave it Blocked and rename it with a prefix such as ZZ-RETIRED-2026 so nobody reuses it.

What an integration record actually is

An integration record does not hold data or workflow. It represents a registered application: NetSuite generates a consumer key and consumer secret for it, and any client that signs requests with that pair is treated as that application. Token-based authentication adds a second pair, the token ID and token secret, which is tied to one user and one role.

That is why deleting the integration record is not enough to stop an exposed credential. The access tokens are separate records, and a token is only usable together with its integration. Conversely, revoking the tokens without blocking the integration leaves the application identity available to anyone who still holds the consumer secret and can obtain a new token.

OAuth 2.0 integrations (authorization code and client credentials flows) use the same Manage Integrations list but store different credentials, such as a client ID, certificate and redirect URI. Treat these the same way: block first, then remove the credentials, then delete.

Block first, delete last

The State field on the integration record has Enabled and Blocked values. Blocked is the right first move for any integration you are not 100 percent sure about. It takes effect immediately, it can be undone by setting the record back to Enabled, and it does not remove tokens, so a mistaken block is a two second fix.

Deleting is only worth doing for housekeeping. NetSuite will typically not let you delete a record that other records still reference, and a deleted integration cannot be restored with the same consumer key. If an auditor later asks which application made a change recorded in system notes, a deleted record leaves you with an unresolved application ID. Many teams keep retired integrations in Blocked state permanently for that reason.

If the integration is a managed SuiteApp or a bundle installed by a vendor, do not delete it by hand. Uninstall or disable the connector from the vendor side or from Customization > SuiteBundler > Search and Install Bundles > List, otherwise the vendor connector may recreate the record or fail with authentication errors.

Finding hidden dependencies

The commonest surprise is a script that nobody remembers. Search your own code repositories and iPaaS flows for the consumer key. Ask the data team about reporting tools that connect through SuiteAnalytics Connect or SOAP, since those can use TBA too. Check for scheduled jobs on a server that only run weekly or quarterly.

Inside NetSuite, the Access Tokens list shows which user and role hold a token, and the last-used information is a good signal when it is available in your release. A token for a user who has left the company is a security finding on its own; revoke it even if the integration stays.

Also confirm that the role attached to the token is not reused elsewhere. The role used for integrations should be a dedicated role with only the permissions required, such as Log in using Access Tokens, REST Web Services or SOAP Web Services, and the specific record permissions. When you retire the integration, review that role as well.

Setup > Integration > Manage Integrations   (set State = Blocked)
Setup > Users/Roles > Access Tokens          (filter by Application Name, revoke)
Setup > Users/Roles > User Management > View Login Audit Trail

Rolling credentials instead of deleting

If the real goal is rotating a leaked secret, you do not need to delete anything. Create a new integration record, issue new tokens to the integration user, update the external system, then block the old record. This gives you a clean cutover with a rollback path.

For compliance reviews, keep a short register of every integration: owner, system, user and role, date created, date last used, and review date. The Manage Integrations list is the source of truth for what exists; the register records why it exists.

Try it here, free

NetSuite OAuth 2.0 Access Token Refresh Calculator

Open full tool

Work out how often your integrations refresh NetSuite OAuth 2.0 access tokens and how many API calls each token serves.

Common pitfalls

  • !Deleting the integration record without revoking tokens or checking logs, then finding a nightly job failing at 2 a.m.
  • !Revoking one token and assuming the integration is dead when other users still hold tokens for the same application.
  • !Leaving the consumer secret in source control or a shared spreadsheet; blocking the record is the only fix once it leaks.
  • !Deleting a vendor-installed connector's integration record by hand instead of uninstalling the SuiteApp.
  • !Reusing one all-powerful role for every integration, so a single revoked token tells you nothing about blast radius.

How an ERP-grounded AI assistant handles this

An AI assistant grounded in your NetSuite data can list every integration record, its tokens, the roles behind them and the last login seen in the audit trail, then flag integrations with no recent activity as block candidates. With ERPray the analysis is read-only and shows the query it ran; the block or revoke itself stays a human action in NetSuite. On-prem or private deployment keeps the audit data inside your network.

See ERPray

Frequently asked questions

Can I delete a NetSuite integration record?

Often yes, from Edit > Delete on the record, but NetSuite may refuse if other records depend on it. It is safer to set State to Blocked and revoke tokens first, then delete later. A deleted integration cannot be restored with the same consumer key.

What is the difference between blocking and revoking?

Blocking the integration record stops every request signed with that application's consumer key and can be reversed by setting it back to Enabled. Revoking an access token kills one user and role's token permanently; a new token must be issued to restore access.

Will blocking an integration break logged-in users?

No. Integrations authenticate through tokens or OAuth, not interactive sessions. Blocking only affects external applications signing requests with that integration's credentials. Normal users logging in through the UI are not affected.

How do I find which systems use an integration?

Use the Access Tokens list filtered by application name, the Web Services Usage Log, the Login Audit Trail and your iPaaS or code repositories for the consumer key. Blocking in a controlled window and watching for failures is the final test.

Related

Advanced

Authenticating NetSuite RESTlets with OAuth 2.0 and Token-Based Authentication

NetSuite RESTlets can be called with either Token-Based Authentication (TBA, OAuth 1.0a signed requests) or OAuth 2.0, and both require a Setup > Integrations > Manage Integrations record before any token is issued. Machine-to-machine OAuth 2.0 uses a client credentials grant with a JWT bearer assertion signed by a certificate; TBA uses a consumer key/secret plus a per-user access token signed with HMAC-SHA256.

Advanced

How NetSuite scheduled script queueing actually works

A Scheduled Script deployment queued behind other jobs is not failing; NetSuite runs a limited number of scheduled and Map/Reduce script queues concurrently per account, so deployments wait their turn based on account concurrency and deployment priority. The practical fixes are staggering trigger times, setting deployment priority correctly, and designing scripts that reschedule themselves cleanly with N/task instead of running one long unbroken execution.

How-to

Connect Oracle Integration Cloud (OIC) To Fusion ERP

OIC connects to Fusion ERP primarily through the prebuilt ERP Cloud Adapter, which wraps Fusion's REST and SOAP web services with OAuth-based authentication and pick-list discovery of available business objects and operations, instead of you hand-building every REST call. Use the adapter for standard integrations; drop to a generic REST or SOAP adapter only when the ERP Cloud Adapter does not yet expose the specific service you need.

Error fix

Fix NetSuite SSS_USAGE_LIMIT_EXCEEDED Error

SSS_USAGE_LIMIT_EXCEEDED fires when a SuiteScript execution consumes all the governance units (usage points) allotted to its script type before it finishes. Fix it by checking runtime.getCurrentScript().getRemainingUsage() before expensive calls, yielding or rescheduling in Scheduled scripts, and moving heavy record-count work into Map/Reduce, which yields automatically across stages.

Error fix

Fix NetSuite INVALID_FLD_VALUE Error

INVALID_FLD_VALUE means NetSuite rejected a value you tried to set on a field because it does not match the field's expected type, list option, or reference record. Fix it by confirming the internal ID or text value actually exists on that field's source list and matches the field's value type (text versus list versus record reference) before setting it.

Error fix

Fix NetSuite SSS_MISSING_REQD_ARGUMENT Error

SSS_MISSING_REQD_ARGUMENT means a NetSuite API call, most often record.create(), record.load(), or search.create(), was called without a parameter that method requires, such as type or id. Fix it by checking the object literal you passed against the current SuiteScript 2.x API signature and confirming no required key is undefined at runtime.

AI for ERP

AI for NetSuite, Beyond the Built-In Text Tools

NetSuite's built-in AI covers text generation, not grounded answers on your own data. See how a private LLM over SuiteQL adds real Q&A and controls.

Stuck on Oracle NetSuite?

Talk to engineers who work inside Oracle NetSuite every week, and who build private AI that answers these questions from your own ERP data.

Talk to an ERP engineerBrowse ERP Help
All ERP Help articles

Keep exploring

Free tools

ERP fixes and how-tos

Runs with your ERP

AI on your ERP

Integrations

Comparisons

Software

TermsRole-Based Access Control (RBAC)TokenNetSuite Advanced ManufacturingNetSuite SuiteFlowNetSuite Saved SearchSuiteScript