Oracle NetSuite is retiring three things many accounts still depend on: SOAP web services, token-based authentication (TBA) for new integrations, and SuiteScript versions older than 2.1. None of them breaks overnight, but the deadlines are close enough that integrations and scripts built years ago need a plan now. Here is what changes, when, and how to find out what in your account is affected.
The timeline at a glance
NetSuite release
What changes
2026.1
Oracle asks that all new integrations use REST web services with OAuth 2.0.
2027.1
New integrations can no longer use TBA, so new SOAP integrations can no longer be built. Existing integrations keep working.
2027.2
Only the last SOAP endpoint (2025.2) is still supported. Older endpoints stay available without support.
2028.2
SOAP web services are removed and every SOAP-based integration stops working. SuiteScript 1.0, 2.0 and 2.x scripts must be on SuiteScript 2.1.
NetSuite upgrades accounts in phases, so the exact date each release reaches your account depends on your upgrade window. Check your account's release preview schedule.
1. SOAP web services are being removed
SuiteTalk SOAP web services have been NetSuite's main integration API for years. Oracle says SOAP no longer meets its standards: new records and features haven't been added to SOAP for a couple of years, it doesn't support NetSuite's newer architecture, and it relies on token-based authentication.
What happens and when
- 2025.2 is the last planned SOAP endpoint. Later endpoints would only ship if needed for significant business or technical reasons.
- With every release, the oldest unsupported endpoint is disabled. Older endpoints are switching off now, before the final removal.
- From 2027.1, you can't build new SOAP integrations. Existing integrations keep running, and existing integration records can still be updated.
- From 2027.2, only the 2025.2 endpoint is supported (bug fixes). Older endpoints are available without support.
- With 2028.2, all SOAP endpoints are disabled and SOAP-based integrations stop working.
Is your SOAP endpoint still available?
Your SOAP endpoint
Supported until
Disabled in
2025.2
2028.1
2028.2
2024.2 – 2025.1
2027.1
2028.2
2024.1
2026.2
2028.2
2023.2
2026.1
2028.2
2021.2 – 2023.1
Already unsupported
2028.2
2021.1
Already unsupported
2028.1
2020.2
Already unsupported
2027.2
2020.1
Already unsupported
2027.1
2019.2
Already unsupported
2026.2
2019.1 and older
—
Already disabled
Source: Oracle's SOAP Removal Plans FAQ. If an integration still points at a 2020 or 2019 endpoint, it will stop working well before 2028.
What replaces SOAP
SuiteTalk REST web services with OAuth 2.0. Oracle says most SOAP use cases can already be built in REST, but it also says not to expect 100% parity: some legacy SOAP functions won't come to REST. Where REST can't do the job, the answer is a SuiteScript RESTlet. Oracle's SOAP Web Services to REST Web Services Upgrade Guide maps each SOAP operation to its alternative. If you still use legacy tax, Oracle recommends moving to SuiteTax rather than waiting for legacy tax support in REST.
In our experience, a SOAP migration is rarely a straight swap. A single SOAP flow often becomes a mix of REST record calls, SuiteQL queries and a RESTlet or two, so it's worth mapping each integration before estimating the work.
Third-party and partner apps
If a connector or app from a partner uses SOAP, ask the vendor for their REST timeline now. For SOAP-based applications built by NetSuite itself, Oracle says it will provide REST-based alternatives.
2. Token-based authentication (TBA): no new integrations from 2027.1
TBA is the OAuth 1.0-style method most NetSuite integrations use today, and it's required for SOAP.
What happens and when
- From 2027.1, you can't create new integrations that use TBA. New integrations must use OAuth 2.0.
- Existing TBA integrations keep working. Oracle says only new integrations must use OAuth 2.0, but it recommends moving existing REST integrations from TBA to OAuth 2.0 as well.
- SOAP integrations can't move to OAuth 2.0, because SOAP requires TBA. They end when SOAP is removed in 2028.2, so the fix for them is migrating to REST.
What it means in practice
Any integration you plan to build after 2027.1 (a new connector, a new middleware flow, a new RESTlet client) needs to be designed around OAuth 2.0 from the start. For server-to-server integrations, that usually means the OAuth 2.0 client credentials flow with a certificate, rather than user-level tokens.
3. SuiteScript 1.0, 2.0 and 2.x must move to 2.1 by 2028.2
SuiteScript 2.1 is now the standard for NetSuite customizations. With the 2028.2 release, scripts written in SuiteScript 1.0, or annotated @NApiVersion 2.0 or @NApiVersion 2.x, need to be on SuiteScript 2.1.
How big is the job?
- SuiteScript 2.0 and 2.x scripts: often a smaller change. The annotation becomes @NApiVersion 2.1, but 2.1 runs on a newer JavaScript engine, so behavior can differ. Every script still needs testing in a sandbox.
- SuiteScript 1.0 scripts: a rewrite. The 1.0 API (nlapi… functions) doesn't exist in 2.x, so each script has to be rebuilt in the module-based 2.1 API, ideally taking the chance to clean up logic that has grown over the years.
- Bundles and SuiteApps: scripts installed by third-party bundles count too. Check with the vendor.
A note on SuiteCommerce
SuiteCommerce and SuiteCommerce Advanced sites may also be affected. Storefronts, especially older SuiteCommerce Advanced versions, can include backend services and customizations written in earlier SuiteScript versions. Oracle hasn't yet detailed how the SuiteScript migration applies to them, so the impact is still to be determined. If you run a SuiteCommerce site, include it in your script inventory now and watch the upcoming release notes. Our SuiteCommerce team can help you review your storefront.
How to check what's affected in your account
1. SOAP integrations
- Review the Web Services Usage Log (Setup > Integration) to see which integrations call SOAP and which endpoint versions they use.
- Don't treat an empty log as proof you're clear: the log doesn't show asynchronous requests, and request details are only kept for a limited time. Cross-check with your integration list and your vendors.
2. TBA integrations
- Go to Setup > Integration > Manage Integrations and note which integration records use token-based authentication.
- Review active access tokens to see which users and roles they belong to.
3. Scripts by SuiteScript version
- Go to Customization > Scripting > Scripts and group or filter the list by API version, or build a saved search on scripts that shows the API version column.
- Flag every 1.0, 2.0 and 2.x script, including scripts installed by bundles.
4. Prioritize
- Integrations on SOAP endpoints that are disabled soonest (see the table above).
- Any new integration planned after 2027.1: design it for REST and OAuth 2.0 now.
- SuiteScript 1.0 rewrites, since they take the longest.
- SuiteScript 2.0 and 2.x annotation updates and testing.
Start with an inventory
The 2028.2 deadline sounds far away, but NetSuite upgrades happen on a schedule you don't fully control, and integrations touch other systems and vendors. The accounts that move early can plan the work around their own calendar instead of an upgrade date.
