How to add WhatsApp to Oracle NetSuite
Short answer
NetSuite has no native WhatsApp channel, so you connect the WhatsApp Business Platform (Cloud API or a BSP) through SuiteScript user event scripts for outbound messages and a RESTlet for inbound replies. Templates, opt-in tracking and a message log record are the parts that need design.
Most NetSuite manufacturers and distributors already have the data customers and suppliers keep asking about by phone: sales order status, shipment tracking, PO acknowledgements, invoice due dates. The people asking are on WhatsApp all day, especially in India, the Middle East, Latin America and Southeast Asia, and nobody wants to log in to a portal to find one status.
NetSuite is a multi-tenant cloud product, so the integration lives on two sides: SuiteScript running inside your account, and a small middleware service that talks to Meta. The ERP never opens a persistent socket to WhatsApp. It fires events outward and exposes a narrow endpoint inward.
The hard part is not the API call. It is the conversation rules: template approval, the 24 hour customer service window, opt-in evidence, and mapping an unstructured reply like 'yes ship Friday' back to the right record without letting a chat message change money fields.
What teams use it for
Order status and shipment alerts
When an Item Fulfillment is shipped, send the customer a template message with the tracking number from the package sublist and the sales order number.
Supplier PO confirmations
Message the vendor contact when a Purchase Order is approved, and capture a Confirm or Reschedule button reply that updates a custom confirmation field on the PO line.
Approval nudges for managers
Send a short alert when a purchase requisition or vendor bill is waiting in SuiteApprovals, with a link to the record rather than an approve button for high value items.
Payment reminders
Push invoice due-date reminders from a saved search of open invoices by days overdue, with a payment link and a way to reply with a promise-to-pay date.
Customer self-service lookups
Let a known customer contact message an order number and get back status, ship date and carrier, using a read-only RESTlet lookup.
Oracle NetSuite integration surface
- SuiteScript 2.x User Event scripts on Item Fulfillment, Sales Order, Purchase Order and Invoice to detect the moment worth messaging, with N/https calls to your middleware.
- Scheduled and Map/Reduce scripts driven by saved searches for batch reminders such as overdue invoices, which keeps governance usage predictable.
- RESTlets (SuiteScript) as the inbound endpoint that your middleware calls with a verified reply, authenticated with token-based authentication or OAuth 2.0.
- SuiteTalk REST Web Services and SuiteQL for reading order and shipment data when the logic runs outside NetSuite instead of inside a script.
- Custom records for the message log and opt-in register, linked to the Customer or Vendor contact, since NetSuite stores phone numbers but not channel consent.
How it works
- 1
Pick the WhatsApp access path
Use the WhatsApp Business Platform Cloud API directly, or a Business Solution Provider if you want a shared inbox. Register a business number that is not already on a personal WhatsApp account, and complete Meta business verification.
- 2
Model consent and the message log
Create a custom record for opt-in evidence (source, timestamp, wording) and one for each message sent or received. Do not rely on the phone field alone as proof of consent.
- 3
Design and submit templates
Write utility templates for shipment, order and reminder messages with named variables. Expect review time, and keep marketing content out of utility templates or they can be reclassified.
- 4
Fire outbound from a user event script
On the afterSubmit of the Item Fulfillment, check status and consent, then post a compact payload to middleware via N/https. Middleware owns retries and the Meta call, so NetSuite never waits on Meta.
- 5
Receive delivery and reply webhooks in middleware
Meta posts delivery receipts and inbound messages to a public HTTPS endpoint. Verify the signature, resolve the sender to a Customer or Vendor contact by normalised phone number, and store the message.
- 6
Write back through a restricted RESTlet
Allow only whitelisted actions: add a note, set a confirmation flag, record a reschedule request for a human. Never let a free text reply edit quantity, price or status.
Example flows
Shipment notification with tracking
Trigger: An Item Fulfillment moves to Shipped.
- User event script reads the sales order, ship-to contact and package tracking numbers.
- Script checks the opt-in custom record for that contact.
- Middleware sends the approved shipment template with order number and tracking link.
- Delivery receipt returns and a message log record is created against the fulfillment.
Result: Customer service stops answering where-is-my-order calls for shipped orders, and the message trail sits on the transaction.
Vendor PO confirmation by button reply
Trigger: A Purchase Order is approved and sent to a vendor.
- Middleware sends a template with Confirm and Request Change buttons.
- Vendor taps Confirm and the webhook resolves the contact and PO number.
- RESTlet sets a custom 'vendor confirmed' field and adds a system note.
- A Request Change tap creates a task for the buyer instead of editing the PO.
Result: Buyers see confirmed versus silent suppliers in a saved search without chasing by phone.
Keeping data on-prem
NetSuite itself is cloud-only, so there is no on-prem NetSuite to keep data inside. What you can keep private is the layer in between. Run the middleware and any intent parsing for free-text replies in your own VPC or data centre with an open-weight model, so customer messages and order data are not sent to a third-party LLM. The ERP calls only reach your service, and your service is the only thing that talks to Meta. Note that WhatsApp message content passes through Meta's infrastructure by design, so decide what is acceptable to put in a template: an order number and status are normally fine, pricing and drawings usually are not.
Security checklist
- Use a dedicated NetSuite integration role with only the record permissions the RESTlet needs, and token-based authentication tied to that role.
- Verify the Meta webhook signature and reject unsigned or replayed calls before touching NetSuite.
- Store opt-in evidence and honour opt-out keywords immediately, including blocking further sends from the user event script.
- Keep sensitive fields out of templates: prices, bank details, drawing numbers and export-controlled part data.
- Log every inbound action with the resolved contact so an audit can reconstruct who changed what and from which message.
Ways to get it done
Marketplace connector or iPaaS flow
Effort: Days to a couple of weeks, plus template approval.
Simple outbound notifications where a generic connector (Celigo, Workato or a SuiteApp from a WhatsApp BSP, if one fits your version) covers your records.
Build in-house with SuiteScript and a small service
Effort: Roughly 3 to 8 weeks depending on two-way flows.
You have a NetSuite developer and want full control of triggers, consent and logging.
Work with a partner such as Netray
Effort: Scoped per flow, typically a few weeks for a pilot.
You want free-text replies understood and routed safely, or the language model kept private.
Pitfalls
- !Sending a message outside the 24 hour window without an approved template; the API will reject it and the script must handle that gracefully.
- !Calling Meta synchronously from afterSubmit, which slows the save and fails the transaction experience when Meta is slow.
- !Matching senders by raw phone string; country codes, spaces and leading zeros cause wrong or missing contact matches.
- !Treating NetSuite's phone field as consent and later discovering you have no opt-in evidence.
- !Letting inbound text write directly to transaction fields, which turns a chat typo into a posted change.
Frequently asked questions
Does NetSuite have a built-in WhatsApp integration?
Not as a core feature. You connect through the WhatsApp Business Platform using SuiteScript and a middleware service, a third-party connector or an iPaaS. Availability of packaged SuiteApps changes over time, so check the SuiteApp catalog for your account before building.
Can customers reply and update a sales order?
They can reply, but the reply should create a note, task or flag rather than edit the order. Structured buttons (Confirm, Request Change) are safer than free text, and anything touching price, quantity or terms should route to a person.
What NetSuite authentication should the middleware use?
Token-based authentication or OAuth 2.0 against a RESTlet or SuiteTalk REST, using a dedicated integration role with minimal permissions. Avoid user credentials. Which option is preferred depends on your account setup and Oracle's current guidance.
How do I avoid hitting NetSuite governance limits?
Keep scripts short, move the Meta call to middleware, batch reminder runs with Map/Reduce and a saved search, and watch concurrency limits for RESTlets and web services. Retries belong in middleware, not in repeated script executions.
Can the replies be understood by AI without sending data to the cloud?
Yes. Run an open-weight model in your own environment to classify intent and extract order numbers from replies, then pass only the structured result to the RESTlet. WhatsApp itself still transports the message through Meta.
Want WhatsApp working on your Oracle NetSuite?
A free 30 minute assessment: we map the integration path for your version and setup, and where it should run.
Get a free assessment