Your team spends hours copying data between systems. Orders sit in Shopify while someone types them into NetSuite by hand. Inventory counts differ across channels. Finance waits for exports that should happen right away. These daily problems come from systems that do not talk to each other.
The NetSuite REST API fixes this by letting your apps connect straight to your ERP. You can sync orders automatically, pull live inventory data, and build custom reports. Oracle will remove SOAP web services with NetSuite 2028.2. REST is now the path forward. If you need help planning your NetSuite integration, start by learning what the REST API can do.
The REST API lets outside systems read and write NetSuite data. It uses standard web protocols. It sends JSON instead of XML. That makes requests smaller and faster. Every modern programming language works with JSON easily.
Think of the REST API as a door into your ERP. Your e-commerce platform can push orders through it. Your warehouse system can pull inventory levels. Your BI tools can query financial data. All without manual exports or file transfers.
Manual data entry creates delays and errors when systems do not share current data. The REST API removes the gap between your tools.
Teams using REST integrations report fewer mistakes. They spend less time on data entry. Orders flow from your store to your ERP without manual work. Inventory updates hit all channels in minutes instead of hours.
The REST API includes several tools:
These features cover most needs. For anything the REST API does not support yet, SuiteScript can fill the gaps.
You need to set up authentication before making API calls. NetSuite supports two main methods. Token-Based Authentication uses OAuth 1.0a. The newer OAuth 2.0 M2M uses certificates and short-lived tokens.
Go to Setup, then Company, then Enable Features. Click the SuiteCloud tab. Check the box for REST Web Services. If you plan to use OAuth 2.0, check that box too. Save your changes.
This step takes about 10 minutes. Without it, all API calls will fail.
Go to Setup, then Integration, then Manage Integrations. Click New. Name your integration something clear like "Shopify Order Sync." Check Token-Based Authentication.
When you save, NetSuite shows your Consumer Key and Consumer Secret. Copy these right away. NetSuite only shows them once. Store them in a secure place.
Go to Setup, then Users/Roles, then Access Tokens. Click New. Select your integration, application, user, and role. Save the record.
NetSuite displays your Token ID and Token Secret. Copy these immediately. You need all four values to sign API requests.
For a detailed walkthrough, see our guide on setting up OAuth 2.0 M2M for REST web services.
Most developers hit problems with OAuth signatures. The signature needs exact formatting. Your timestamp must be in seconds, not milliseconds. All parameters must be sorted alphabetically.
Use a proven library like requests-oauthlib for Python or oauth-1.0a for Node.js. Building your own signature code leads to hours of debugging.
SuiteQL is NetSuite's SQL-like query language. It runs through the REST API and returns JSON results. For most read operations, SuiteQL beats the standard record endpoints.
REST record responses contain record data and HATEOAS links. Some related data may need expansion or another request. You often need multiple calls to get what you want.
SuiteQL returns complete data in one request. You can join tables, filter results, and sort data. It feels like writing normal SQL queries.
Here is a query that pulls recent sales orders with customer info:
SELECT t.tranid, t.trandate, c.companyname, t.amount
FROM transaction t
JOIN customer c ON t.entity \= c.id
WHERE t.type \= 'SalesOrd'
AND t.trandate >= '2025-01-01'
ORDER BY t.trandate DESC
You send this to the SuiteQL endpoint as a POST request. The response contains all matching records in JSON format.
SuiteQL returns a maximum of 1,000 rows per response. For larger datasets, you need pagination. Follow the links.next value in each response until you reach the end.
The total result limit is 100,000 rows per query. If your query returns more, split it into smaller date ranges or ID chunks.
The REST API organizes data by record type. Each type has its own endpoint URL. The base URL follows this pattern:
https://{accountID}.suitetalk.api.netsuite.com/services/rest/record/v1/{recordType}
REST uses standard HTTP methods for different actions:
For example, GET /customer/123 returns customer 123. POST /salesOrder with a JSON body creates a new order.
NetSuite uses concurrency-based limits. Your account base limit is 5, 15, or 20 concurrent requests based on service tier. Each SuiteCloud Plus license adds 10 requests. Exceed this, and you get an error.
Build retry logic into your integration. When you hit a limit, wait a few seconds and try again. Most developers use exponential backoff. Wait 2 seconds, then 4, then 8. This prevents hammering the API during busy periods.
Here are practical examples in Python and JavaScript. These show real patterns you can adapt for your projects.
import requests
from requests_oauthlib import OAuth1
auth \= OAuth1(
'consumer\_key',
'consumer\_secret',
'token\_id',
'token\_secret',
realm='YOUR\_ACCOUNT\_ID',
signature\_method='HMAC-SHA256'
)
url \= 'https://ACCOUNT.suitetalk.api.netsuite.com/services/rest/record/v1/customer'
response \= requests.get(url, auth=auth)
customers \= response.json()
order_data \= {
"entity": {"id": "123"},
"item": {
"items": \\\[
{"item": {"id": "456"}, "quantity": 2}
\\\]
}
}
url \= 'https://ACCOUNT.suitetalk.api.netsuite.com/services/rest/record/v1/salesOrder'
response \= requests.post(url, json=order_data, auth=auth)
query \= {
"q": "SELECT id, companyname FROM customer WHERE is inactive \= 'F'"
}
url \= 'https://ACCOUNT.suitetalk.api.netsuite.com/services/rest/query/v1/suiteql'
response \= requests.post(url, json=query, auth=auth)
results \= response.json()
A skilled NetSuite developer can adapt these patterns for your specific business needs.
Security matters when your API can read financial data and create transactions. NetSuite provides several layers of protection.
OAuth 2.0 Machine-to-Machine uses certificates and short-lived tokens. NetSuite OAuth 2.0 access tokens remain valid for 3,600 seconds. Even if someone steals a token, it stops working quickly.
Setting up OAuth 2.0 takes more work. You need to create certificates and set up the integration differently. But the extra security is worth it for production systems.
Every integration runs under a NetSuite role. That role controls what the integration can see and do. Create dedicated roles for integrations. Give them only the permissions they need.
For example, an order sync integration might need access to sales orders and customers. It probably does not need access to payroll or journal entries. Limit the role properly.
Our guide on NetSuite roles and permissions explains how to set this up correctly.
You can restrict API access to specific IP addresses. This adds another layer of protection. Even with valid credentials, requests from unknown IPs get blocked.
Go to Setup, then Company, then Company Information. Look for IP Address Rules. Add the IPs of your servers and middleware platforms.
Each integration method has its place. The right choice depends on what you need to build.
Pick REST when you build new integrations. It works best for connecting outside systems like e-commerce platforms, CRMs, and BI tools. REST handles standard data operations well.
Pick SuiteScript when you need custom logic inside NetSuite. It can trigger actions on record saves, run scheduled tasks, and build custom UIs. Many teams use SuiteScript and REST together.
Learn more about creating NetSuite workflows for automated business processes.
SOAP only makes sense if you have existing integrations that work. Do not build anything new with SOAP. Start planning your move to REST now. You have until 2028.2, but migrations take time.
Here are three common cases where REST API delivers clear value.
Problem - Manual order entry from Shopify takes 5 to 10 minutes per order. Staff makes mistakes on 15% to 20% of entries.
Solution - REST API syncs orders automatically. When a customer completes checkout, the system creates a NetSuite sales order right away.
Result - Orders enter NetSuite with less manual work, while staff focus on exceptions.
If you use Shopify with NetSuite, check out our Shopify NetSuite integration guide.
Problem - A retailer sells on multiple channels. Stock levels get out of sync. Oversells happen regularly.
Solution - SuiteQL queries poll for inventory changes every 5 minutes. Updates push to all sales channels.
Result - Customers receive more reliable stock information across sales channels.
Problem - Finance spends 3 to 4 hours daily exporting data to build reports.
Solution - Scheduled SuiteQL queries pull transaction data. Results feed straight into BI dashboards.
Result - Reports refresh with less manual exporting and spreadsheet work.
The REST API works well for these situations:
Even experienced developers hit snags with the REST API. Here are the most common issues.
This is the most common problem. Your signature might be wrong because:
Fix - Use a library like requests-oauthlib. Test in Postman first.
You sent too many requests at once. NetSuite blocks extra requests.
Fix - Add exponential backoff. Queue requests in your app. Monitor usage in Integration Management.
REST record endpoints return main record data. You expected related sublist data too.
Fix - Add ?expandSubResources=true to your URL. Or switch to SuiteQL for reads.
You created a custom field but cannot find it in the API.
Fix - Check the field's script ID, role permissions, audience, record support, and Records Catalog metadata.
For tricky integration problems, our free 30-minute NetSuite fix can help you get unstuck.
Building REST API integrations is not hard. Building them well takes experience. At Anchor Group, we have helped dozens of companies connect their systems to NetSuite.
Our team has built integrations for wholesale distributors, manufacturers, and e-commerce retailers. We know where things go wrong. We plan for rate limits, handle edge cases, and build in proper error logging.
Here is what makes working with us different:
If you plan a REST API project or move from SOAP, contact our NetSuite consulting team. We can review your current setup and recommend the best path forward.
REST uses JSON and modern OAuth authentication. SOAP uses XML and older protocols. REST uses modern web standards, but performance depends on request design, record type, account load, and integration architecture. Oracle will remove SOAP with NetSuite 2028.2. New integrations should use REST exclusively.
You need four credentials from NetSuite. These are Consumer Key, Consumer Secret, Token ID, and Token Secret. Use these to sign each request with OAuth 1.0a. Libraries like requests-oauthlib handle the signing for you. Authentication may be set up quickly, but production needs proper mapping, security, error handling, and testing.
Yes. Custom records appear in the REST API once you enable them. They use internal IDs like customrecord_myrecord. Use the REST API Browser to find the correct endpoint and field names. Check role permissions and record audience settings if a custom record does not appear.
NetSuite base concurrency limits are 5, 15, or 20 requests based on service tier. Each SuiteCloud Plus license adds 10 requests. If you exceed the limit, you get an error. Build retry logic with exponential backoff to handle busy periods. Monitor usage through Integration Management.
Authentication may be set up quickly, but a production integration also needs mapping, security, error handling, and testing. A simple order sync typically takes 1 to 2 weeks including proper testing. Complex multi-system integrations take 1 to 3 months. Sandbox testing adds time but prevents production problems.
Related Articles
