Gah, I left out the Content-type header. There was an "Accept"-header in there, and it's 2:41 at night over here, and in my defense NetSuite is not.. well, not good quality software.