NetSuite 2026.1 Release Notes: Developers & IT Architects

This is Part 2 of our NetSuite 2026.1 Release Notes Series. Part 1 covered Finance & Accounting. Today we shift to the backend — REST APIs, SuiteScript, authentication, and SDF.

For developers and IT architects, 2026.1 delivers meaningful API expansions, a long-requested SuiteScript runtime upgrade, and a new AI coding assistant. There is also a security section that requires immediate planning: TBA deprecation timelines are now confirmed.

---

REST Web Services

NetSuite continues expanding REST Web Services with four new operations that remove some of the most persistent limitations in integration work.

Homogeneous Batch Operations

You can now add, update, delete, or upsert multiple records of the same type in a single asynchronous REST request. This eliminates the round-trip overhead that made REST impractical for large-scale data imports — the kind of workload that previously forced teams toward CSV imports or async SuiteScript jobs.

If you are building integrations that push high-volume records (transactions, inventory updates, customer data), this is the most impactful change in this release.

Attach and Detach Operations

Programmatic relationship management between records is now available via REST. You can link or unlink instances directly — for example, attaching a contact to a partner or a file to an opportunity — without workarounds through record updates.

The create-form Operation

This operation returns a record form prepopulated with field values, allowing your application to emulate a NetSuite UI workflow. A practical use case: reference a sales order to initialize fields on a new invoice, then modify only the fields that differ before submitting. It reduces the logic your integration needs to own when mirroring native NetSuite behavior.

The selectOptions Operation

You can now retrieve valid dropdown options for specific records and fields via REST. This means your external UIs can accurately reflect NetSuite's internal option lists and role-based permissions without hardcoding values that drift out of sync.

---

SuiteScript & Developer Tooling

Execute SuiteScript 2.0 as 2.1

A new global preference lets you run existing SuiteScript 2.0 server scripts on the SuiteScript 2.1 runtime engine without rewriting them. This is the recommended path to validate 2.1 compatibility and capture performance improvements before committing to a migration.

Enable it in a sandbox first. Most scripts will run cleanly — but any that rely on 2.0-specific behaviors worth catching before production.

PATCH Method Support

The N/http and N/https modules now support the PATCH HTTP method for both external calls and internal Suitelet requests. Overdue, but welcome — particularly for integrations with REST APIs that follow standard partial-update conventions.

N/llm Module — OpenAI GPT-OSS Support

The N/llm module now supports the OpenAI GPT-OSS model, expanding the options available for AI-powered SuiteScript workflows. Custom Tool Scripts used for AI connectors also now expose detailed execution logs, making it significantly easier to debug and monitor AI integrations.

SuiteCloud Developer Assistant for VS Code

The SuiteCloud Extension for Visual Studio Code is getting an AI-powered coding assistant, integrated via the Cline extension. It supports SuiteScript 2.1 authoring, XML object management, and context-aware assistance that understands the SuiteCloud project structure.

For teams that spend significant time in VS Code for SDF-based development, this is a meaningful productivity addition. Worth testing early to build it into your workflow before broad adoption.

---

Authentication & Security — Action Required

This section requires planning. NetSuite has confirmed deprecation timelines that affect any integration using TBA.

Token-Based Authentication (TBA) Deprecation — Target: 2027.1

As of NetSuite 2027.1, creating new integrations using TBA with SOAP, REST, or RESTlets will no longer be possible. Existing TBA integrations continue to work past that date, but all new integrations must use OAuth 2.0.

The practical implication: if your roadmap includes new integrations in 2026 or early 2027, build them with OAuth 2.0 now. Do not start new TBA-based integrations at this point.

PKCE Required for OAuth 2.0 — Target: 2027.1

Also in 2027.1, all new integrations using the OAuth 2.0 authorization code grant flow will require PKCE (Proof Key for Code Exchange) parameters — regardless of whether the client is public or confidential. If you are building OAuth 2.0 integrations today, implement PKCE from the start to avoid rework.

2FA Required for Multiple Sessions

Multiple simultaneous NetSuite sessions now require administrator opt-in, and only users assigned to roles with Two-Factor Authentication (2FA) enforced can use the feature. If your team relies on concurrent sessions — common in power-user or developer workflows — review your role configuration and 2FA settings before upgrading.

Certificate Limits

A maximum of five active certificates per integration record is now enforced. Review your current certificate inventory for any integrations approaching or exceeding this limit.

---

SuiteCloud Development Framework (SDF)

beforeUndeploy Hook

You can now define custom logic to execute immediately before a SuiteApp is uninstalled. The primary use case is cleanup: automatically deleting custom records, files, or folders that would otherwise be left behind after uninstallation. If you manage SuiteApps with persistent data, this hook closes a gap that previously required manual post-uninstall steps.

File Permissions via XML

File permissions for .ss and .ssp files can now be defined directly in your SDF project XML definitions. This removes the need to set permissions manually in the NetSuite UI after deployment — a step that was easy to forget and harder to enforce consistently across environments.

---

Our Take

The REST expansions in 2026.1 are genuinely useful, particularly batch operations. If you are building new integrations, the REST layer is now the right default choice — the gap between REST and SuiteTalk/SOAP has narrowed significantly.

The TBA deprecation timeline is the most operationally important item here. 2027.1 sounds distant, but integrations take time to audit, redesign, and test. Start that inventory now.

The SuiteCloud Developer Assistant is worth watching. Early access to AI-assisted SuiteScript authoring in VS Code could materially change how teams onboard new developers to the platform.

At BrokenRubik, we work with development teams navigating NetSuite integrations, SDF deployments, and OAuth migrations. Get in touch to discuss how these changes affect your architecture.