NetSuite REST API: A Developer's Guide to Integration & Endpoints

Your team spends hours copying data between systems. Orders sit in Shopify while someone types them into NetSuite by hand. Inventory counts differ across channels. Finance waits for exports that should happen right away. These daily problems come from systems that do not talk to each other.

The NetSuite REST API fixes this by letting your apps connect straight to your ERP. You can sync orders automatically, pull live inventory data, and build custom reports. Oracle will remove SOAP web services with NetSuite 2028.2. REST is now the path forward. If you need help planning your NetSuite integration, start by learning what the REST API can do.

Key Takeaways

• Oracle will remove SOAP web services with NetSuite 2028.2
• NetSuite base concurrency limits are 5, 15, or 20 requests based on service tier
• SuiteQL returns 1,000 results per page with 100,000 total result limit
• REST batch operations handle up to 100 records of the same type
• REST supports many record types. Oracle maintains the current list in its REST documentation
• Authentication may be set up quickly, but production needs mapping, security, error handling, and testing

Understanding the NetSuite REST API

The REST API lets outside systems read and write NetSuite data. It uses standard web protocols. It sends JSON instead of XML. That makes requests smaller and faster. Every modern programming language works with JSON easily.

Think of the REST API as a door into your ERP. Your e-commerce platform can push orders through it. Your warehouse system can pull inventory levels. Your BI tools can query financial data. All without manual exports or file transfers.

Why REST Matters for Your Business

Manual data entry creates delays and errors when systems do not share current data. The REST API removes the gap between your tools.

Teams using REST integrations report fewer mistakes. They spend less time on data entry. Orders flow from your store to your ERP without manual work. Inventory updates hit all channels in minutes instead of hours.

Key Features of the REST API

The REST API includes several tools:

• SuiteQL Query Engine - Write SQL-like queries to pull data from multiple record types
• Record API - Create, read, update, and delete many record types
• REST API Browser - Interactive docs showing all endpoints and field definitions
• Batch Operations - Process up to 100 records of the same type in one request

These features cover most needs. For anything the REST API does not support yet, SuiteScript can fill the gaps.

Setting Up REST API Authentication

You need to set up authentication before making API calls. NetSuite supports two main methods. Token-Based Authentication uses OAuth 1.0a. The newer OAuth 2.0 M2M uses certificates and short-lived tokens.

Step 1: Enable REST Web Services

Go to Setup, then Company, then Enable Features. Click the SuiteCloud tab. Check the box for REST Web Services. If you plan to use OAuth 2.0, check that box too. Save your changes.

This step takes about 10 minutes. Without it, all API calls will fail.

Step 2: Create an Integration Record

Go to Setup, then Integration, then Manage Integrations. Click New. Name your integration something clear like "Shopify Order Sync." Check Token-Based Authentication.

When you save, NetSuite shows your Consumer Key and Consumer Secret. Copy these right away. NetSuite only shows them once. Store them in a secure place.

Step 3: Generate Access Tokens

Go to Setup, then Users/Roles, then Access Tokens. Click New. Select your integration, application, user, and role. Save the record.

NetSuite displays your Token ID and Token Secret. Copy these immediately. You need all four values to sign API requests.

For a detailed walkthrough, see our guide on setting up OAuth 2.0 M2M for REST web services.

Common Authentication Mistakes

Most developers hit problems with OAuth signatures. The signature needs exact formatting. Your timestamp must be in seconds, not milliseconds. All parameters must be sorted alphabetically.

Use a proven library like requests-oauthlib for Python or oauth-1.0a for Node.js. Building your own signature code leads to hours of debugging.

Using SuiteQL for Data Queries

SuiteQL is NetSuite's SQL-like query language. It runs through the REST API and returns JSON results. For most read operations, SuiteQL beats the standard record endpoints.

Why SuiteQL Works Better

REST record responses contain record data and HATEOAS links. Some related data may need expansion or another request. You often need multiple calls to get what you want.

SuiteQL returns complete data in one request. You can join tables, filter results, and sort data. It feels like writing normal SQL queries.

Example SuiteQL Query

Here is a query that pulls recent sales orders with customer info:

SELECT t.tranid, t.trandate, c.companyname, t.amount

FROM transaction t

JOIN customer c ON t.entity \= c.id

WHERE t.type \= 'SalesOrd'

AND t.trandate >= '2025-01-01'

ORDER BY t.trandate DESC

You send this to the SuiteQL endpoint as a POST request. The response contains all matching records in JSON format.

SuiteQL Limits to Know

SuiteQL returns a maximum of 1,000 rows per response. For larger datasets, you need pagination. Follow the links.next value in each response until you reach the end.

The total result limit is 100,000 rows per query. If your query returns more, split it into smaller date ranges or ID chunks.

Working with REST API Endpoints

The REST API organizes data by record type. Each type has its own endpoint URL. The base URL follows this pattern:

https://{accountID}.suitetalk.api.netsuite.com/services/rest/record/v1/{recordType}

Common Record Endpoints

HTTP Methods and What They Do

REST uses standard HTTP methods for different actions:

• GET - Read a record or list records
• POST - Create a new record
• PATCH - Update specific fields on a record
• DELETE - Remove a record

For example, GET /customer/123 returns customer 123. POST /salesOrder with a JSON body creates a new order.

Handling Rate Limits

NetSuite uses concurrency-based limits. Your account base limit is 5, 15, or 20 concurrent requests based on service tier. Each SuiteCloud Plus license adds 10 requests. Exceed this, and you get an error.

Build retry logic into your integration. When you hit a limit, wait a few seconds and try again. Most developers use exponential backoff. Wait 2 seconds, then 4, then 8. This prevents hammering the API during busy periods.

Code Examples for Common Tasks

Here are practical examples in Python and JavaScript. These show real patterns you can adapt for your projects.

Python: Fetching Customers

import requests

from requests_oauthlib import OAuth1

auth \= OAuth1(

'consumer\_key',

'consumer\_secret',

'token\_id',

'token\_secret',

realm='YOUR\_ACCOUNT\_ID',

signature\_method='HMAC-SHA256'

)

url \= 'https://ACCOUNT.suitetalk.api.netsuite.com/services/rest/record/v1/customer'

response \= requests.get(url, auth=auth)

customers \= response.json()

Python: Creating a Sales Order

order_data \= {

"entity": {"id": "123"},

"item": {

"items": \\\[

    {"item": {"id": "456"}, "quantity": 2}

\\\]

}

}

url \= 'https://ACCOUNT.suitetalk.api.netsuite.com/services/rest/record/v1/salesOrder'

response \= requests.post(url, json=order_data, auth=auth)

Running a SuiteQL Query

query \= {

"q": "SELECT id, companyname FROM customer WHERE is inactive \= 'F'"

}

url \= 'https://ACCOUNT.suitetalk.api.netsuite.com/services/rest/query/v1/suiteql'

response \= requests.post(url, json=query, auth=auth)

results \= response.json()

A skilled NetSuite developer can adapt these patterns for your specific business needs.

Securing Your REST API Connections

Security matters when your API can read financial data and create transactions. NetSuite provides several layers of protection.

OAuth 2.0 M2M for Enhanced Security

OAuth 2.0 Machine-to-Machine uses certificates and short-lived tokens. NetSuite OAuth 2.0 access tokens remain valid for 3,600 seconds. Even if someone steals a token, it stops working quickly.

Setting up OAuth 2.0 takes more work. You need to create certificates and set up the integration differently. But the extra security is worth it for production systems.

Role-Based Access Control

Every integration runs under a NetSuite role. That role controls what the integration can see and do. Create dedicated roles for integrations. Give them only the permissions they need.

For example, an order sync integration might need access to sales orders and customers. It probably does not need access to payroll or journal entries. Limit the role properly.

Our guide on NetSuite roles and permissions explains how to set this up correctly.

IP Whitelisting

You can restrict API access to specific IP addresses. This adds another layer of protection. Even with valid credentials, requests from unknown IPs get blocked.

Go to Setup, then Company, then Company Information. Look for IP Address Rules. Add the IPs of your servers and middleware platforms.

REST API vs SOAP vs SuiteScript

Each integration method has its place. The right choice depends on what you need to build.

When to Choose REST API

Pick REST when you build new integrations. It works best for connecting outside systems like e-commerce platforms, CRMs, and BI tools. REST handles standard data operations well.

When to Choose SuiteScript

Pick SuiteScript when you need custom logic inside NetSuite. It can trigger actions on record saves, run scheduled tasks, and build custom UIs. Many teams use SuiteScript and REST together.

Learn more about creating NetSuite workflows for automated business processes.

When SOAP Still Makes Sense

SOAP only makes sense if you have existing integrations that work. Do not build anything new with SOAP. Start planning your move to REST now. You have until 2028.2, but migrations take time.

Real-World Integration Use Cases

Here are three common cases where REST API delivers clear value.

E-commerce Order Automation

Problem - Manual order entry from Shopify takes 5 to 10 minutes per order. Staff makes mistakes on 15% to 20% of entries.

Solution - REST API syncs orders automatically. When a customer completes checkout, the system creates a NetSuite sales order right away.

Result - Orders enter NetSuite with less manual work, while staff focus on exceptions.

If you use Shopify with NetSuite, check out our Shopify NetSuite integration guide.

Real-Time Inventory Sync

Problem - A retailer sells on multiple channels. Stock levels get out of sync. Oversells happen regularly.

Solution - SuiteQL queries poll for inventory changes every 5 minutes. Updates push to all sales channels.

Result - Customers receive more reliable stock information across sales channels.

Automated Financial Reporting

Problem - Finance spends 3 to 4 hours daily exporting data to build reports.

Solution - Scheduled SuiteQL queries pull transaction data. Results feed straight into BI dashboards.

Result - Reports refresh with less manual exporting and spreadsheet work.

Who Should Use the REST API

Strong Fit

The REST API works well for these situations:

• You build new integrations from scratch
• You connect e-commerce platforms like Shopify or BigCommerce to NetSuite
• Your team has developers who know OAuth and JSON
• You want real-time data sync between systems
• You need SQL-like queries for reporting

Common Problems and How to Fix Them

Even experienced developers hit snags with the REST API. Here are the most common issues.

OAuth Signature Errors (401 Unauthorized)

This is the most common problem. Your signature might be wrong because:

• Timestamp is in milliseconds instead of seconds
• Parameters are not sorted alphabetically
• URL encoding is incorrect

Fix - Use a library like requests-oauthlib. Test in Postman first.

Concurrency Limit Exceeded

You sent too many requests at once. NetSuite blocks extra requests.

Fix - Add exponential backoff. Queue requests in your app. Monitor usage in Integration Management.

Related Data Not Showing

REST record endpoints return main record data. You expected related sublist data too.

Fix - Add ?expandSubResources=true to your URL. Or switch to SuiteQL for reads.

Custom Fields Not Showing

You created a custom field but cannot find it in the API.

Fix - Check the field's script ID, role permissions, audience, record support, and Records Catalog metadata.

For tricky integration problems, our free 30-minute NetSuite fix can help you get unstuck.

How Anchor Group Can Help with Your REST API Projects

Building REST API integrations is not hard. Building them well takes experience. At Anchor Group, we have helped dozens of companies connect their systems to NetSuite.

Our team has built integrations for wholesale distributors, manufacturers, and e-commerce retailers. We know where things go wrong. We plan for rate limits, handle edge cases, and build in proper error logging.

Here is what makes working with us different:

• We do the technical heavy lifting. You tell us what data needs to flow where. We handle OAuth, SuiteQL queries, and retry logic.
• We plan for the long term. Your integration should work next year, not just next week. We build maintainable code with clear documentation.
• We know when REST is not the answer. Sometimes SuiteScript or a pre-built connector makes more sense. We tell you the truth, even when it means less work for us.

If you plan a REST API project or move from SOAP, contact our NetSuite consulting team. We can review your current setup and recommend the best path forward.

Frequently Asked Questions

What is the difference between NetSuite REST API and SOAP API?

REST uses JSON and modern OAuth authentication. SOAP uses XML and older protocols. REST uses modern web standards, but performance depends on request design, record type, account load, and integration architecture. Oracle will remove SOAP with NetSuite 2028.2. New integrations should use REST exclusively.

How do I authenticate my requests to the NetSuite REST API?

You need four credentials from NetSuite. These are Consumer Key, Consumer Secret, Token ID, and Token Secret. Use these to sign each request with OAuth 1.0a. Libraries like requests-oauthlib handle the signing for you. Authentication may be set up quickly, but production needs proper mapping, security, error handling, and testing.

Can I access custom records through the REST API?

Yes. Custom records appear in the REST API once you enable them. They use internal IDs like customrecord_myrecord. Use the REST API Browser to find the correct endpoint and field names. Check role permissions and record audience settings if a custom record does not appear.

What are the rate limits for the NetSuite REST API?

NetSuite base concurrency limits are 5, 15, or 20 requests based on service tier. Each SuiteCloud Plus license adds 10 requests. If you exceed the limit, you get an error. Build retry logic with exponential backoff to handle busy periods. Monitor usage through Integration Management.

How long does it take to set up a basic REST integration?

Authentication may be set up quickly, but a production integration also needs mapping, security, error handling, and testing. A simple order sync typically takes 1 to 2 weeks including proper testing. Complex multi-system integrations take 1 to 3 months. Sandbox testing adds time but prevents production problems.