NetSuite 2026.1 for Integrators: 5 Changes That Touch Your Code (and One Silent Breaker)

NetSuite 2026.1 is fully rolled out across accounts as of this writing, with 2026.2 now entering its own phased rollout. Five 2026.1 changes touch integration code directly: two add REST capability, one tightens OAuth certificate limits, one sets a hard authentication deadline, and one — an item subrecord rename — breaks existing queries with no error message at all. This is the corrected, current field guide: verified line by line against Oracle’s live 2026.1 release notes, not a snapshot from when the release was still in preview. For the wider sync architecture these changes sit inside, see the NetSuite–WooCommerce integration guide.

1. REST Sublist Replacement Is a Query Parameter, Not a Body Flag

NetSuite’s REST Record API replaces sublist lines — order items, addresses — through a replace query parameter on the request URL, not a field inside the JSON payload. Two modes exist: ?replace=sublist for keyed sublists, where lines are matched against the incoming request by their key columns (unmatched existing lines are removed, matched lines are updated in place); and ?replace=unkeyedsublist for non-keyed sublists, where every existing line is removed and the incoming lines are inserted as new. Without the query parameter, a PATCH request adds or updates only the lines you send — it does not remove lines missing from the payload.

PATCH /record/v1/salesOrder/12345?replace=sublist
Content-Type: application/json

{
  "item": {
    "items": [
      { "key1": "99", "quantity": 5, "rate": 42.50 },
      { "key1": "101", "quantity": 2, "rate": 19.00 }
    ]
  }
}
// Lines matching key1 "99" or "101" are updated.
// Any other existing line is removed. No other line is touched
// unless it is present in this request.

Code written against the assumption of a JSON replaceAll flag never worked — there is no such field. Audit any PATCH call touching sublists for the query parameter, not the body, before assuming replace behavior is configured correctly.

2. Two New REST Operations Cut Round Trips: Attach/Detach and Batch

2026.1 adds an attach/detach operation pair for defining or removing relationships between two record instances directly through REST, without a full record update. Today it covers contact and file records only — for example, attaching a contact to a customer, or a file to an opportunity — via a URL pattern rather than a payload:

POST /record/v1/customer/660/!attach/contact/106

The second addition, homogeneous batch operations, lets one REST request add, update, delete, or upsert multiple instances of the same record type — useful for bulk order or line-item imports that previously required one call per record. Batch requests execute asynchronously: the response returns a job reference, not the final result, so integration code needs a poll or callback step rather than treating the initial response as complete. Both operations reduce network round trips for high-volume syncs, at the cost of new async-completion handling that a naive synchronous integration does not yet have.

3. OAuth 2.0 M2M: Five Active Certificates Per Integration Record

2026.1 caps each integration record at five active client-credentials certificates for machine-to-machine OAuth 2.0. Revoked certificates do not count against the limit — only active ones do. Integrations that rotate certificates by adding a new one before revoking the old, rather than swapping in place, can hit the cap during a rotation window if prior revocations were never cleaned up. Before the next certificate rotation, check the integration record’s current active-certificate count rather than assuming headroom; a rotation that fails on the sixth certificate is not a subtle bug to chase later, it is a limit to check first.

4. TBA Sunsets for New Integrations in 2027.1 — PKCE Becomes Mandatory

Two authentication deadlines land together in NetSuite 2027.1, one release after the one this post tracks, but both require planning now: token-based authentication (TBA) stops accepting new integration setups, and every new OAuth 2.0 authorization-code-grant integration must implement PKCE (Proof Key for Code Exchange) on both the authorization and token requests. Existing TBA integrations keep working past 2027.1 — Oracle has only committed to ending support for new TBA setups at that point, with a tentative, not final, end-of-support date for existing integrations in 2027.1’s successor release. Any integration still using TBA today, or scaffolding a new one, should treat OAuth 2.0 as the only credential type worth deploying going forward — TBA and OAuth 2.0 M2M are separate credential paths, and this deadline does not touch M2M certificates at all.

5. The Silent Breaker: Item Subrecord Script ID Renames

Oracle publishes the full old-to-new identifier mapping under SuiteAnswers ID 1025032. Treat that mapping as a pre-upgrade diff target, not a post-incident lookup: run every saved SuiteQL query, REST integration payload, and SuiteAnalytics Connect report referencing item subrecord fields against it before the account upgrades, since nothing in the failure path throws an exception to flag the rows that need fixing.

Verdict: default to no replace parameter for additive updates; reach for ?replace=sublist only when the payload is meant to be the new complete state of a keyed sublist, and ?replace=unkeyedsublist only when every line should be rebuilt from scratch. Never assume a JSON body field controls this — it does not.

2026.1 Upgrade Audit Checklist

Run this before the account upgrades to 2026.1, or immediately after if the upgrade already happened. Each item maps to one of the five changes above.

• Diff every saved SuiteQL query and SuiteAnalytics Connect report against the item subrecord script ID mapping (SuiteAnswers 1025032) before the upgrade window.
• Grep integration code for a JSON replaceAll field on sublist PATCH calls — replace it with the correct ?replace= query parameter or remove it if additive behavior is actually intended.
• Check each integration record’s active OAuth 2.0 M2M certificate count before the next scheduled rotation; clean up stale revocations if near five.
• Confirm no new integration work is being scaffolded on TBA — start any new build on OAuth 2.0 instead.
• If building a new OAuth 2.0 authorization-code-grant integration, implement PKCE now rather than retrofitting it before 2027.1.
• Evaluate whether high-volume bulk syncs (order backfills, catalog imports) should move to the new homogeneous batch operation instead of per-record REST calls.
• Confirm any code polling for batch operation completion handles the async job-reference response, not just a synchronous 200.

Frequently asked questions

Related guides

• WooCommerce ↔ NetSuite Sync: The Complete Guide for 2026
• 7 Things That Break NetSuite ↔ WooCommerce Integrations (and How to Avoid Them)
• The State of NetSuite Development in 2026: What Changed, What’s Next