It looks like

<https://rest.netsuite.com/rest/roles>

was no longer working for us, i had to use

<https://rest.na2.netsuite.com/rest/roles>

, which kind of defeats the purpose of domain lookup...