Log inGet started

Proxy NetSuite under a concurrency limit

When to use this

NetSuite enforces account-level concurrency. Bursts from integrations often force extra SuiteCloud Plus capacity. Pin NetSuite origins, set Max concurrency to your SuiteTalk limit, and let swarmvia queue or retry when callers burst.

swarmvia does not treat NetSuite as a special product mode. You pin the https origins yourself and attach a managed OAuth 2.0 client-credentials credential.

Origins to pin

Replace {account} with your account id, lowercased, with underscores turned into hyphens (1234567_SB1 → 1234567-sb1):

Host Typical use
https://{account}.suitetalk.api.netsuite.com SuiteTalk REST (most common)
https://{account}.restlets.api.netsuite.com RESTlets
https://{account}.app.netsuite.com Suitelets on system/app
https://{account}.extforms.netsuite.com External Suitelets

Most teams only need the SuiteTalk origin. Put multiple hosts on one source when those hosts must share the same concurrency budget. Your plan caps how many origins a source may list.

Requests go to the first origin unless the caller sends X-Swarmvia-Origin with an exact configured origin.

Setup

  1. Create a source and pin the NetSuite origin(s) under Settings.
  2. On Credentials, add an OAuth 2.0 client credentials credential and choose Private key JWT. Generate certificate, download the certificate, and upload it in NetSuite’s Client Credentials (M2M) setup. NetSuite accepts the PS* and ES* algorithm families and rejects RS* signatures (UnsupportedAlgo). PS256 with its 4096-bit RSA certificate is the usual choice; ES256, ES384, and ES512 use EC P-256, P-384, and P-521 keys. Shorter RSA keys are rejected. The form names the certificate type for the algorithm you select. Paste the Certificate ID from that mapping into Certificate ID, and set Scope to the comma-separated values NetSuite expects, such as rest_webservices. NetSuite also requires the certificate id as kid; a missing one comes back as invalid_client. Set the Token URL to https://{account}.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token and the Client ID to the integration’s client id. Saving asks the token endpoint for an access token before anything is stored; a scope NetSuite does not recognize comes back as invalid_scope.
  3. On the source’s Access tab, choose Managed and attach that credential.
  4. Set Max concurrency to your safe SuiteTalk concurrency (or use Adaptive with that value as the max concurrency).
  5. On Access, for SuiteQL with writes blocked, add POST under the keys and set that method's path prefix to /services/rest/query/. Give the integration a Control API token so it mints its own access keys (sv_at_…) and refreshes them before they expire. See Refresh access tokens before they expire. For a quick curl check, use Create test key on the same tab.
  6. Point your integration at https://‹source›.swarmvia.cloud/... instead of the NetSuite host directly. Send X-Swarmvia-Key (or Authorization: Bearer on managed sources).
curl -sS "https://ns-prod.swarmvia.cloud/services/rest/record/v1/customer" \
  -H "X-Swarmvia-Key: $ACCESS_KEY" \
  -H "Accept: application/json"

Tips

  • Enable Retry on 429 so transient NetSuite throttles are absorbed at the edge.
  • Use access-log tags (X-Swarmvia-Tags) to separate Celigo / custom jobs in the Logs UI.
  • A connector that only takes a fixed header value (many iPaaS settings work this way) gets a 7-day key. Replace it on a schedule, every 5 days or so; see fixed-header integrations.
  • Prefer adaptive mode when you are unsure of the true concurrency limit; keep a conservative cap.
  • Interactive and batch jobs on the same account should share a Capacity budget. Use Auto balancing so spare slots follow load under one SuiteTalk concurrency limit.

See also