So probably you need to use a suitelet instead of restlet, and use the

X-Shopify-Hmac-SHA256

header to verify on NetSuite end