It's been too long since I worked with Restlets, and the documentation is not clear on a few things: • How external systems should get the domains of restlets on your NS account. The docs mention using the roles service, but the URLs provided in the documentation either go to a Page Not Found page, or an 400 error message {"error" : {"code" : "USER_ERROR", "message" : "You provided an invalid Authorization header."}} . Because of this, I'm thinking of just giving them the hardcoded restlet URL. • What permissions are required on Role and User of the Access Token being used by the external system in order to make the requests to the Restlet. They think we need Rest Web Services enabled, but I was making external requests to Netsuite Restlets a few years before Rest Web Services even existed, so that doesn't sound correct.

On the script deployment page you have the restlest url. The external system needs to create headers for the Authorization using oauth 1 or 2. You will have to provide them tokens.

Thanks @raghav - I think the problem is the 3rd party is trying to request a SuiteQL service endpoint and not our Restlet. I'm going to ask them why they're hitting SuiteQL instead of what we agreed on.

The REST Roles Service is to be used when you wish to dynamically discover the domain of an account you have access to. Its what you use when you want a robust solution that will handle when netsuite changes the domain of an account