[Due for payment 30th March, 2026] [$250] Allow updating NetSuite tokens without resetting connection configuration

[yuwenmemon]

Problem

When a user needs to update their NetSuite token credentials — whether due to an authentication error, token rotation, or any other reason — the App calls ConnectPolicyToNetSuite, which triggers an initConnection job on the backend. This resets all user configuration (subsidiary, export destinations, mappings, custom segments, etc.).

There is no way to update NetSuite credentials without wiping out the entire connection setup. Users are forced to reconfigure everything from scratch just to rotate tokens. This feature exists in OldDot:

Solution

The backend now supports a new API command UpdateNetSuiteTokens that validates and updates credentials, then triggers a sync — all while preserving existing config. The App needs to use this new command when the user already has an existing NetSuite connection and is updating their credentials.

The current UI surface for this is the token input form shown when a connection has isAuthenticationError === true. In that flow, the App should call UpdateNetSuiteTokens instead of ConnectPolicyToNetSuite. Fresh first-time connections should continue using ConnectPolicyToNetSuite.

Changes needed

1. Add write command — src/libs/API/types.ts

• Add UPDATE_NETSUITE_TOKENS: 'UpdateNetSuiteTokens' to the WRITE_COMMANDS enum (near the other UPDATE_NETSUITE_* entries).
• Add its type mapping using the existing ConnectPolicyToNetSuiteParams type (same parameters: policyID, netSuiteAccountID, netSuiteTokenID, netSuiteTokenSecret).

2. Add action function — src/libs/actions/connections/NetSuiteCommands.ts

• Add and export an updateNetSuiteTokens(policyID, credentials) function.
• It should mirror connectPolicyToNetSuite (same optimistic data for sync progress) but use WRITE_COMMANDS.UPDATE_NETSUITE_TOKENS.

3. Update form submission — src/pages/workspace/accounting/netsuite/NetSuiteTokenInput/substeps/NetSuiteTokenInputForm.tsx

• Import updateNetSuiteTokens from NetSuiteCommands.
• Import isAuthenticationError from @libs/actions/connections.
• Import usePolicy from @hooks/usePolicy (the SubStepWithPolicy type only provides policyID, not the full policy object).
• Call usePolicy(policyID) to get the policy.
• In the connectPolicy callback: if isAuthenticationError(policy, CONST.POLICY.CONNECTIONS.NAME.NETSUITE) is true, call updateNetSuiteTokens; otherwise call connectPolicyToNetSuite as before.

How to verify

1. Token update scenario: With a NetSuite connection that has configured settings, simulate an auth error (set isAuthenticationError: true on the connection's lastSync in Onyx) → re-enter credentials → verify network request goes to UpdateNetSuiteTokens (not ConnectPolicyToNetSuite).
2. Fresh connection scenario: Connect NetSuite for the first time → verify the request still goes to ConnectPolicyToNetSuite.
3. Run npm run typecheck, npm run prettier, and lint on changed files.

Related to https://github.com/Expensify/Expensify/issues/598576

Issue Owner

Current Issue Owner: @truph01

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022025938927275723055
• Upwork Job ID: 2025938927275723055
• Last Price Increase: 2026-02-23

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @truph01 (External)

[melvin-bot]

Unable to auto-create job on Upwork. The BZ team member should create it manually for this issue.

[melvin-bot]

Triggered auto assignment to @trjExpensify (NewFeature), see https://stackoverflowteams.com/c/expensify/questions/14418#:~:text=BugZero%20process%20steps%20for%20feature%20requests for more details. Please add this Feature request to a GH project, as outlined in the SO. Remember to draft any necessary HelpDot updates by following the instructions here.

[melvin-bot]

Triggered auto assignment to Design team member for new feature review - @dannymcclain (NewFeature)

[imgyf]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When users need to update their NetSuite token credentials (due to auth errors, token rotation, etc.), the app calls ConnectPolicyToNetSuite which triggers initConnection on the backend — wiping all existing configuration (subsidiary, export destinations, mappings, custom segments). There's no way to update credentials without losing the entire connection setup.

What is the root cause of that problem?

In src/pages/workspace/accounting/netsuite/NetSuiteTokenInput/substeps/NetSuiteTokenInputForm.tsx, the connectPolicy callback always calls connectPolicyToNetSuite() regardless of whether this is a fresh connection or a credential update for an existing connection. The backend now supports UpdateNetSuiteTokens which preserves config, but the frontend doesn't use it yet.

What changes do you think we should make in order to solve the problem?

1. Add write command — src/libs/API/types.ts

Add UPDATE_NETSUITE_TOKENS to the WRITE_COMMANDS enum near the other UPDATE_NETSUITE_* entries (~line 377):

UPDATE_NETSUITE_TOKENS: 'UpdateNetSuiteTokens',

And add the type mapping using the existing params type (~line 983):

[WRITE_COMMANDS.UPDATE_NETSUITE_TOKENS]: Parameters.ConnectPolicyToNetSuiteParams;

2. Add action function — src/libs/actions/connections/NetSuiteCommands.ts

Add and export updateNetSuiteTokens, mirroring connectPolicyToNetSuite (same optimistic data for sync progress) but using WRITE_COMMANDS.UPDATE_NETSUITE_TOKENS:

function updateNetSuiteTokens(policyID: string, credentials: Omit<ConnectPolicyToNetSuiteParams, 'policyID'>) {
    const optimisticData: Array<OnyxUpdate<typeof ONYXKEYS.COLLECTION.POLICY_CONNECTION_SYNC_PROGRESS>> = [
        {
            onyxMethod: Onyx.METHOD.MERGE,
            key: `${ONYXKEYS.COLLECTION.POLICY_CONNECTION_SYNC_PROGRESS}${policyID}`,
            value: {
                stageInProgress: CONST.POLICY.CONNECTIONS.SYNC_STAGE_NAME.NETSUITE_SYNC_CONNECTION,
                connectionName: CONST.POLICY.CONNECTIONS.NAME.NETSUITE,
                timestamp: new Date().toISOString(),
            },
        },
    ];
    const parameters: ConnectPolicyToNetSuiteParams = {
        policyID,
        ...credentials,
    };
    API.write(WRITE_COMMANDS.UPDATE_NETSUITE_TOKENS, parameters, {optimisticData});
}

Export it alongside connectPolicyToNetSuite.

3. Update form submission — NetSuiteTokenInputForm.tsx

Import the new action and the auth error check:

import {connectPolicyToNetSuite, updateNetSuiteTokens} from '@libs/actions/connections/NetSuiteCommands';
import {isAuthenticationError} from '@libs/actions/connections';
import usePolicy from '@hooks/usePolicy';

Use usePolicy to get the full policy object (since SubStepWithPolicy only provides policyID), then branch in the connectPolicy callback:

const policy = usePolicy(policyID);

const connectPolicy = useCallback(
    (formValues: FormOnyxValues<typeof ONYXKEYS.FORMS.NETSUITE_TOKEN_INPUT_FORM>) => {
        if (!policyID) {
            return;
        }

        if (isAuthenticationError(policy, CONST.POLICY.CONNECTIONS.NAME.NETSUITE)) {
            updateNetSuiteTokens(policyID, formValues);
        } else {
            connectPolicyToNetSuite(policyID, formValues);
        }
        onNext();
    },
    [onNext, policyID, policy],
);

This way, fresh first-time connections continue using ConnectPolicyToNetSuite, while credential updates on existing connections with auth errors use UpdateNetSuiteTokens — preserving all user configuration.