Enable Token-Based Authentication in NetSuite under Setup > Company > Enable Features > SuiteCloud > Token-Based Authentication; create an Integration record to get a Consumer Key and Consumer Secret.
Create a dedicated Employee with the appropriate role, then generate an Access Token and Token Secret under Setup > Users/Roles > Access Tokens — you now have four values: Consumer Key, Consumer Secret, Token ID, Token Secret.
Sign requests using OAuth 1.0a (HMAC-SHA256); the Authorization header must include oauth_consumer_key, oauth_token, oauth_signature_method, oauth_timestamp, oauth_nonce, oauth_version, and oauth_signature — plus 'realm' set to your account ID.
Your base URL is https://{accountId}.suitetalk.api.netsuite.com/services/rest/query/v1/suiteql — replace {accountId} with your NetSuite account ID (e.g., 1234567 or 1234567_SB1 for sandbox).
POST to the SuiteQL endpoint with header 'prefer: transient' and a JSON body of {'q': 'SELECT id, companyName, email FROM customer WHERE isInactive = \'F\' LIMIT 100'}.
Paginate results using the 'links' array in the response (rel=next), or use OFFSET/LIMIT in your SuiteQL query — default page size is 1000 rows maximum.
Known gotchas
The OAuth 1.0a signature is extremely sensitive to parameter ordering and encoding — use a proven OAuth library rather than hand-rolling the signature; even minor whitespace or encoding differences cause 401 INVALID_LOGIN_ATTEMPT errors.
NetSuite sandbox account IDs append '_SB1' (or _SB2, etc.) to the production account ID; pointing production credentials at a sandbox URL or vice versa returns auth errors that look identical to invalid credential errors.
SuiteQL does not support all record types that are available via SOAP (SuiteQL covers the schema in the 'Analytics Data Store' — some custom record types may not appear); verify table availability in the SuiteQL schema browser before writing queries.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp