got it. it didn't like

<http://system.sandbox.netsuite.com|system.sandbox.netsuite.com>

but

<http://system.netsuite.com|system.netsuite.com>

pulled in all accounts including sandbox.