thanks mmoen! looks like part 1 of the issue is that I had the header

Content-Type: application/JSON

, and NetSuite wasn't actually sending JSON so rails was trying to parse something that wasn't JSON. Removing that is allowing Rails to figure out what's actually coming in- though it's still only properly parsing 1st tier key/values