Connect Oracle NetSuite to WhatsApp

NetSuite is an enterprise ERP, not a developer-first SaaS. Every integration path requires an Administrator to create an Integration Record in NetSuite. The most common authentication method (TBA/OAuth 1.0a) also requires a cryptographically signed request header that standard HTTP tools cannot generate without custom code. Read this guide fully before starting. The RESTlet middleware approach is often the simplest path for most teams.

This guide covers Path A (OAuth 2.0 + SuiteQL) and Path B (RESTlet middleware). TBA is noted for reference but not recommended for new builds.

Your NetSuite instance URL follows the pattern https://ACCOUNT_ID.app.netsuite.com. The API base URL is https://ACCOUNT_ID.suitetalk.api.netsuite.com/services/rest. All sandbox accounts append _SB1 to the account ID but use a hyphen in the URL: ACCOUNT_ID-sb1.

1. In Integration Record (Setup > Integration > Manage Integrations):
   Enable OAuth 2.0, set callback URL, note Client ID and Client Secret.

2. Direct the NetSuite admin to authorise at:
   https://ACCOUNT_ID.app.netsuite.com/app/login/oauth2/authorize.nl
     ?client_id=YOUR_CLIENT_ID
     &response_type=code
     &redirect_uri=YOUR_CALLBACK_URL
     &scope=rest_webservices
     &state=RANDOM_STRING

3. After admin approves, exchange the code for tokens:
   POST https://ACCOUNT_ID.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token
   Content-Type: application/x-www-form-urlencoded
   Body:
     grant_type=authorization_code
     &client_id=YOUR_CLIENT_ID
     &client_secret=YOUR_CLIENT_SECRET
     &redirect_uri=YOUR_CALLBACK_URL
     &code=AUTHORISATION_CODE

4. Response:
   { "access_token": "...", "refresh_token": "...", "expires_in": 3600 }

Store the access_token and refresh_token.
Refresh using refresh_token before the 1-hour expiry.

NetSuite's SuiteQL endpoint requires the Prefer: transient header on every POST request. Without it, the API returns a 400 error. This is unique to NetSuite. No other platform in this series requires it.

{
  "totalResults": 1,
  "count": 1,
  "hasMore": false,
  "items": [
    {
      "id": "142",
      "companyname": "Sharma Textiles Pvt Ltd",
      "email": "priya@sharma.com",
      "phone": "9820000001"
    }
  ],
  "offset": 0
}

Map: items[0].companyname, items[0].email, items[0].phone

NetSuite SuiteQL returns field names in lowercase regardless of how they appear in the UI. companyName in the UI becomes companyname in the API response. Map as items[0].companyname (all lowercase).

What your NetSuite developer deploys:

A SuiteScript 2.x RESTlet at a URL like:
  https://ACCOUNT_ID.restlets.api.netsuite.com/app/site/hosting/restlet.nl
    ?script=SCRIPT_ID&deploy=DEPLOY_ID&apikey=YOUR_SIMPLE_KEY&phone=PHONE_NUMBER

The RESTlet internally:
1. Validates the simple apikey
2. Queries res.customer WHERE phone = phone_param
3. Returns clean JSON: { "name": "...", "email": "...", "city": "..." }

What WA.Expert calls (simple, no OAuth required):
GET https://ACCOUNT_ID.restlets.api.netsuite.com/app/site/hosting/restlet.nl
  ?script=123&deploy=1&apikey=MY_SIMPLE_KEY&phone={{customer_phone}}
Authorization: NLAuth nlauth_account=ACCOUNT_ID,nlauth_email=USER@COMPANY.COM,
               nlauth_signature=PASSWORD,nlauth_role=ROLE_ID

Note: NLAuth uses the NetSuite admin's email + password in the header.
This is simpler than OAuth 1.0a TBA but still requires setup.
Ask your NetSuite admin for the NLAuth header values.

Your NetSuite developer writes the RESTlet once and controls what data it exposes. WA.Expert's External API Request step then calls a clean simple endpoint. No per-request OAuth 1.0a signature generation. No token expiry to manage. One API call per chatbot lookup.

In SuiteQL, 'customer' is the internal table name. 'entity' is the customer's internal ID. Field names return lowercase in the response. NetSuite's internal IDs are numeric strings.