NetSuite · OAuth 1.0
401 Unauthorized from a NetSuite RESTlet
- What is happening
- The OAuth 1.0 signature base string must include the URL's query parameters (the ?script= and &deploy= on the RESTlet URL). If the signing routine builds the base string from the bare URL and drops the query params, the signature it produces does not match what NetSuite recomputes, so NetSuite rejects it as 401. Calls with no query string sign correctly and succeed, which is why the failure looks intermittent.
- How to fix it
- Parse the full RESTlet URL, extract its query parameters, and merge them with the OAuth parameters before computing the signature base string. The script and deploy IDs have to be part of what you sign, not just part of where you send it.
- Prevent it
- Route every OAuth-signed call through one signing function instead of hand-rolling per call, and add a test fixture whose URL carries query parameters so a regression in the base-string logic fails the test, not production.
