WRF Drupal API — NetSuite Integration

Inbound REST interface. Pick an environment in the Servers dropdown, then Authorize to test live calls.

Test

NetSuite sandbox 9336228-SB1. Do all integration work here.

https://e3test.waterrf.org

Production

NetSuite production 9336228. Live content.

https://www.waterrf.org

Token lifetime

300 seconds, no refresh token. Fetch a token immediately before the batch it authorises.

POST /oauth/token

Two things break most calls

Every URL needs the format parameter; every write needs the JSON content type.

?_format=json
Content-Type: application/json
Testing mode is on — two prerequisites apply. 1. Serve this page from https://wrf-api.robs.ws. CORS allows that origin plus https://sandbox.waterrf.org and the existing wrftechlink origins. Opened from file:// the browser sends Origin: null and every call fails. 2. The Cloudflare WAF must skip the API paths. CORS controls what the browser allows; the WAF decides whether the request reaches Drupal at all. See Unblocking a Cloudflare 403. Failures are opaque. A blocked call shows only TypeError: Failed to fetch. Reproduce it with curl -i to see the real status and headers before drawing conclusions.
Never paste a production client secret into Authorize. The Authorize dialog sends your client_secret from the browser and keeps the token in localStorage. That is fine for test/sandbox credentials on a machine you control. For production use curl or ./health-check.sh prod instead.