NetSuite 2026.2 Release Notes: Developers & IT Architects

This is the second installment of our NetSuite 2026.2 Release Notes Series, broken down by role so you only read what applies to your work.

For developers, 2026.2 has one change that can silently alter existing behavior, two genuinely useful REST additions, and a set of authentication deadlines that are now close enough to plan around.

A note on sourcing. This is based on Oracle's Release Preview release notes for 2026.2, which every page marks as subject to change. Details can shift before general availability, and we will update this post if Oracle revises them.

Read this first: the SuiteQL default sort changed

SuiteQL queries and Analytics datasets based on generic transactions now use Transaction.tranDate as the default sort field when no sort order is specified. They previously used Transaction.tranDisplayName. Oracle made the change to prevent performance problems.

Queries and datasets that specify a sort order are unaffected. Everything else may return rows in a different order than it did last week.

This is the sort of change that does not throw an error. It produces different output from the same code, and it surfaces somewhere downstream — a report whose top row feeds a summary, an integration that takes the first result, a script that assumes chronological grouping without asking for it.

-- Implicit ordering: behavior changed in 2026.2
SELECT id, tranid, trandate FROM transaction WHERE type = 'SalesOrd'
 
-- Explicit ordering: unaffected, and what you should be writing
SELECT id, tranid, trandate FROM transaction WHERE type = 'SalesOrd'
ORDER BY trandate DESC

Practical approach: grep your SuiteScript, RESTlets, saved datasets, and iPaaS flows for SuiteQL without an ORDER BY, and add one wherever the result order carries meaning. Our SuiteQL guide covers the syntax if you are formalizing this across a codebase.

Bound parameters in REST SuiteQL

You can now use anonymous bound parameters in SuiteQL search operations through REST web services. A bound parameter is a placeholder whose value is supplied separately at execution time, which is the correct way to handle user input rather than concatenating it into the query string.

POST {{REST_SERVICES}}/query/v1/suiteql
Prefer: transient
 
{
  "q": "SELECT * FROM item WHERE id BETWEEN ? AND ?",
  "params": [ "-7", "0" ]
}

One or many parameters per request are supported. If you have been building SuiteQL strings by interpolation anywhere that touches user-supplied values, this is the fix — and it is worth treating as a security cleanup, not just a convenience.

Sequential batch operations in REST web services

Batch operations in REST already reduced round trips by processing multiple records in a single request. What they could not do is guarantee order, which ruled them out whenever records depended on each other.

2026.2 adds sequential batch processing, which runs operations in the order specified in the request. Oracle calls out two cases:

• Parent-child creation in one batch, where child records reference the parent's external ID.
• Inventory adjustments, transfers, or builds, where the order of operations determines availability and allocation.

Batch operations still run asynchronously. If you have been decomposing dependent work into separate sequential calls to preserve ordering, this collapses that back into one request.

Authentication: the 2027.1 wall is now visible

Three deprecations land in the same release, and all three point at OAuth 2.0. None of them break anything in 2026.2 — they break things in 2027.1, which is one release away.

NLAuth for RESTlets ends in 2027.1. Every integration using NLAuth as its authentication method stops working. Existing integrations using the IssueToken endpoint are excluded from this particular end of support.

No new TBA integrations from 2027.1. You will not be able to create new integrations using Token-Based Authentication, covering both the IssueToken endpoint and the three-step TBA authorization flow. Existing TBA integrations keep working — but this is groundwork for full TBA end of support, tentatively planned for 2028.1.

PKCE becomes mandatory in 2027.1. PKCE was previously optional for the OAuth 2.0 authorization code grant flow with a private client, and required only for public clients. From 2027.1 it is required for all new integrations using that flow. Existing integrations without PKCE keep working.

The practical read: if you own integrations on NLAuth or TBA, the OAuth 2.0 migration is a 2026 project. Two release cycles sounds like room until you count how many of those integrations were written by someone who no longer works there. Our NetSuite API guide covers the authentication options.

SuiteBuilder: AI Description, and why it matters more than it looks

AI Description fields are now available on custom records, custom fields, and custom transaction definitions for all customers. They appear in the main body of each definition page, take up to 280 characters, and have an Optimize for AI action that rewrites the description for machine consumption.

The reason this is not just metadata hygiene: these descriptions are what NetSuite's AI features use to understand what your custom objects actually mean. That includes the NetSuite AI Connector Service, which uses Model Context Protocol (MCP) to connect external AI platforms — ChatGPT, Claude — to your NetSuite data.

In other words, if you are planning to point an AI assistant at your NetSuite instance, the quality of these descriptions is the quality of the answers you get back. A custom record called custrecord_pj_stat_v2 means nothing to a model. A 280-character description of what it holds and when it is written means a great deal. We covered the plumbing in our NetSuite AI Connector Service post.

Advanced Record Customization (ARC) arrives alongside it, at Customization > Advanced Record Customization. It is a centralized layer where administrators review, manage, and override record definitions from one place, with overrides applied at account level. Notably, when an ARC override exists, changes made elsewhere in NetSuite or by installed partner solutions are not applied — so it is an override in the strong sense, and worth understanding before a SuiteApp vendor wonders why their update did nothing.

AI Description is the first attribute ARC can override. It supports both custom and selected standard record types, and lets you add descriptions for SuiteApps and bundles whose owners did not provide one, compare default against override, and revert.

Currency context for currency custom fields rounds out SuiteBuilder. A new Currency Symbol Field on a Currency Context subtab lets you associate a currency with values in Currency-type custom fields, which previously stored bare numbers. Reports and analytics can then display and process them currency-aware. It is optional, does not change existing fields until configured, and supports export/import through SuiteApps and bundles. Transaction forms and saved searches are unaffected.

SuiteApp Control Center: more lifecycle automation

The SuiteApp Control Center REST API gains endpoints for the parts of the lifecycle that still required a human:

• A PATCH endpoint to publish a pending SuiteApp version or deprecate a released one.
• A PUT endpoint to upgrade SuiteApp installations to a selected version.
• The GET endpoint now takes query parameters returning only installations eligible for managed upgrade, filterable by upgrade phase (leading or lagging). Without an explicit phase it defaults to leading.

These require the Release Manager role. If you publish SuiteApps, this is the release pipeline you have been scripting around.

SuiteCloud SDK: not yet available

Worth setting expectations with your team before someone spends an afternoon on it. As of these release notes, none of the 2026.2 SuiteCloud SDK tooling has shipped:

• SuiteCloud Extension for Visual Studio Code — not yet available
• SuiteCloud CLI for Node.js — not yet available
• SuiteCloud IDE Plug-in for WebStorm — not yet available
• SuiteCloud CLI for Java — not yet available

Oracle's note is simply to check back for announcements. The VS Code extension is open source on GitHub if you want to watch the repository rather than the release notes.

What we would test first

1. Every SuiteQL query and dataset without an explicit ORDER BY. This is the only change in 2026.2 that alters existing behavior without an error.
2. Your authentication inventory. Not a 2026.2 test — a 2026.2 audit. List what runs on NLAuth and TBA, and put the OAuth 2.0 migration on a roadmap with a date.
3. AI Description coverage on your custom objects, if an AI assistant against NetSuite is anywhere on your plan.

Your account's upgrade date is in the New Release portlet on your dashboard. The rest of the series — finance, system administrators, operations, and sales and pricing — is indexed on our complete NetSuite 2026.2 breakdown, which also lists every change by feature area. For the wider 2026 cycle, see the NetSuite 2026 release notes hub.

Frequently asked questions