fix(netsuite): complete integration validation

Author: Bill Leoutsakos

apps/docs/content/docs/en/integrations/netsuite-service-account.mdx

@@ -65,20 +65,21 @@ Selecting the credential enables these account-backed fields:
 | Field | Lists | Additional scope |
 | --- | --- | --- |
 | Record Type | Up to 1,000 record types visible in the metadata catalog | credential |
-| SuiteAnalytics Dataset | The first 1,000 datasets visible to the role | credential |
 | Async Task | Up to 100 tasks belonging to a known batch job | job ID |
 
-Picker results reflect the selected role's permissions. Switch any picker to Advanced mode to type an identifier or reference an upstream output. Record IDs, job IDs, transform targets, actions, fields, forms, subresources, and relationship IDs remain manual because NetSuite does not expose a bounded universal listing that would make those choices complete and reliable.
+Picker results reflect the selected role's permissions. Switch any picker to Advanced mode to type an identifier or reference an upstream output. Enter SuiteAnalytics dataset IDs manually after finding them with **List SuiteAnalytics Datasets**. Record IDs, job IDs, transform targets, actions, fields, forms, subresources, and relationship IDs also remain manual because NetSuite does not expose bounded universal listings that would make those choices complete and reliable.
+
+**Create Record** without `replace` returns HTTP 204 with no response body; with `replace`, it returns HTTP 201 and the created record object. Both responses expose NetSuite's validated `location`. The `replace` option applies to create and update, not upsert.
 
 ## Rotate or Revoke
 
-To rotate a certificate, create and upload the replacement certificate, create the new NetSuite mapping, then reconnect the existing Sim credential with the new Certificate ID and private key. Reconnecting changes the encrypted credential fingerprint, so later executions mint against the new material.
+To rotate a certificate, create and upload the replacement certificate and create its new NetSuite mapping. Then reconnect the existing Sim credential by re-entering all four required fields: SuiteTalk URL, Client ID, the new Certificate ID, and the replacement private key. Reconnecting changes the encrypted credential fingerprint, so later executions mint against the new material.
 
-After confirming workflows succeed, remove the old certificate mapping in NetSuite. Deleting a Sim credential removes its workflow bindings but does not revoke the corresponding NetSuite certificate mapping.
+After confirming workflows succeed, remove the old certificate mapping in NetSuite so the previous certificate can no longer mint tokens. Deleting a Sim credential removes its workflow bindings but does not revoke the corresponding NetSuite certificate mapping.
 
 <FAQ items={[
   { question: "Why can’t I paste the key into each block?", answer: "The signing key is long-lived account material. Keeping it in one encrypted credential avoids duplicating it in workflow state and lets every block reuse the same verified account connection." },
-  { question: "Why is my picker empty?", answer: "The pickers use the selected integration role. Confirm that role can access the metadata catalog, datasets, or async job, then use Advanced mode when you already know an identifier." },
+  { question: "Why is my picker empty?", answer: "The pickers use the selected integration role. Confirm that role can access the metadata catalog or async job, then use Advanced mode when you already know an identifier." },
   { question: "Can one credential access production and sandbox?", answer: "No. Each environment has its own SuiteTalk URL and client-certificate mapping. Create one Sim credential per environment." },
   { question: "Why did the credential stop working after a sandbox refresh?", answer: "NetSuite clears OAuth 2.0 client-credential mappings during a sandbox refresh. Recreate the mapping and reconnect the Sim credential with its new Certificate ID." },
   { question: "Does deleting the credential revoke it in NetSuite?", answer: "No. Remove the certificate mapping in NetSuite as well when decommissioning or responding to a compromise." },

apps/docs/content/docs/en/integrations/netsuite.mdx

@@ -26,9 +26,11 @@ import { BlockInfoCard } from "@/components/ui/block-info-card"
 ## Usage notes
 
 - Record fields and supported actions vary by account, enabled features, custom records, forms, role, and permissions. Use **List Record Types** and **Get Record Metadata** before constructing create, update, upsert, action, or transform bodies. Sim intentionally accepts JSON for these dynamic record shapes instead of guessing a fixed schema.
-- Select the stored NetSuite account once per block. Record Type, SuiteAnalytics Dataset, and known-job Async Task fields use account-backed pickers; switch a field to Advanced mode to type or reference an identifier that is not present in the bounded picker result.
+- Select the stored NetSuite account once per block. Record Type and known-job Async Task fields use account-backed pickers; switch a field to Advanced mode to type or reference an identifier that is not present in the bounded picker result. Enter SuiteAnalytics dataset IDs manually after finding them with **List SuiteAnalytics Datasets**.
+- **Create Record** without `replace` returns NetSuite's HTTP 204 response with no body; with `replace`, it returns HTTP 201 and the created record object. Both cases expose the validated `location` returned by NetSuite. The `replace` option applies to create and update, not upsert.
 - Paged operations return one page only. The default limit is 100, the maximum is 1,000, and the offset must be a non-negative multiple of the limit. Sim never fetches later pages automatically. Requests must stay within NetSuite's first 100,000 results and first 1,000 pages.
 - Homogeneous batch operations accept 1–100 records of one record type and always run asynchronously. NetSuite processes records in parallel, and individual tasks can fail independently; submission is not an all-or-none transaction. Preserve the returned `location` or `jobId`, use **Get Async Status** with **Job Status** until the job completes, choose **List Tasks** to collect task IDs, check each ID with **Task Status**, then use completed IDs with **Get Async Operation Result**. Canceling or timing out the local Sim request does not cancel a batch that NetSuite has already accepted.
+- Sim gives the OAuth token exchange and each SuiteTalk request up to 30 seconds. A timed-out request fails locally, but a mutation that NetSuite already accepted may still finish remotely.
 - Sim limits each materialized request body and successful SuiteTalk response to 16 MiB. Request JSON is also limited to 100 levels of nesting and 100,000 JSON values. Split work into smaller pages or batches when a request or response would exceed these ceilings, even if NetSuite would otherwise accept the payload.
 - When attaching a contact with a role, provide either the role's internal ID or external ID, not both. File attachments do not use a contact role.
 - **Attach/Detach**, homogeneous batch operations, **Get Record Form**, and **Get Select Options** require a NetSuite 2026.1-compatible account. Oracle introduced these SuiteTalk REST capabilities in [NetSuite 2026.1](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N3950559.html).
@@ -150,7 +152,6 @@ Create or update a NetSuite record by external ID with PUT.
 | `recordType` | string | Yes | NetSuite REST record type script ID, such as customer or salesOrder |
 | `externalId` | string | Yes | External ID without the eid: prefix |
 | `body` | json | Yes | Record fields matching the account-specific NetSuite metadata schema |
-| `replace` | string | No | Comma-separated sublists whose existing lines should be replaced |
 
 #### Output
 

apps/sim/app/api/credentials/route.test.ts

@@ -146,7 +146,7 @@ describe('POST /api/credentials', () => {
     })
   })
 
-  describe('client-credential service accounts', () => {
+  describe('service-account credentials', () => {
     it('forwards clientId, clientSecret, and orgId to the secret builder on create', async () => {
       mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
         providerId: 'zoom-service-account',
@@ -252,42 +252,88 @@ describe('POST /api/credentials', () => {
       )
     })
 
-    it('conflicts for an existing non-NetSuite service account instead of dropping new secrets', async () => {
-      mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
+    it.each([
+      {
+        family: 'client-credential',
         providerId: 'zoom-service-account',
-        encryptedServiceAccountKey: 'new-secret-ciphertext',
-        displayName: 'Production Zoom',
-        auditMetadata: {},
-        principal: { kind: 'tenant', id: 'zoom-account' },
-      })
-      queueTableRows(credential, [
-        {
-          id: 'existing-credential',
-          workspaceId: WORKSPACE_ID,
-          type: 'service_account',
-          displayName: 'Production Zoom',
-          providerId: 'zoom-service-account',
-        },
-      ])
-
-      const response = await POST(
-        createMockRequest('POST', {
-          workspaceId: WORKSPACE_ID,
-          type: 'service_account',
-          providerId: 'zoom-service-account',
-          displayName: 'Production Zoom',
+        fields: {
           orgId: 'zoom-account',
           clientId: 'new-client-id',
           clientSecret: 'new-client-secret',
+        },
+      },
+      {
+        family: 'token-paste',
+        providerId: 'snowflake-service-account',
+        fields: {
+          domain: 'acme.snowflakecomputing.com',
+          apiToken: 'new-programmatic-access-token',
+        },
+      },
+      {
+        family: 'Google JSON-key',
+        providerId: 'google-service-account',
+        fields: {
+          serviceAccountJson: JSON.stringify({
+            type: 'service_account',
+            client_email: 'automation@example.iam.gserviceaccount.com',
+            private_key: 'new-private-key',
+            project_id: 'example-project',
+          }),
+        },
+      },
+      {
+        family: 'Atlassian',
+        providerId: 'atlassian-service-account',
+        fields: { domain: 'example.atlassian.net', apiToken: 'new-atlassian-token' },
+      },
+      {
+        family: 'Slack different-ID',
+        providerId: 'slack-custom-bot',
+        fields: {
+          id: '33333333-4444-4555-8666-777777777777',
+          signingSecret: 'new-slack-signing-secret',
+          botToken: 'xoxb-new-slack-bot-token',
+        },
+      },
+    ])(
+      'conflicts for an existing $family service account instead of dropping new secrets',
+      async ({ providerId, fields }) => {
+        const displayName = 'Production automation'
+        mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
+          providerId,
+          encryptedServiceAccountKey: 'new-secret-ciphertext',
+          displayName,
+          auditMetadata: {},
+          principal: null,
         })
-      )
-      const body = await response.json()
-
-      expect(response.status).toBe(409)
-      expect(body.code).toBe('duplicate_display_name')
-      expect(dbChainMockFns.update).not.toHaveBeenCalled()
-      expect(dbChainMockFns.insert).not.toHaveBeenCalled()
-    })
+        queueTableRows(credential, [
+          {
+            id: 'existing-credential',
+            workspaceId: WORKSPACE_ID,
+            type: 'service_account',
+            displayName,
+            providerId,
+          },
+        ])
+
+        const response = await POST(
+          createMockRequest('POST', {
+            workspaceId: WORKSPACE_ID,
+            type: 'service_account',
+            providerId,
+            displayName,
+            ...fields,
+          })
+        )
+        const body = await response.json()
+
+        expect(response.status).toBe(409)
+        expect(body.code).toBe('duplicate_display_name')
+        expect(dbChainMockFns.update).not.toHaveBeenCalled()
+        expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+      }
+    )
 
     it('preserves an exact-ID Slack custom-bot create replay', async () => {
       const credentialId = '22222222-3333-4444-8555-666666666666'