General Token Record Now Exposed via SuiteTalk REST API

What changed

NetSuite has exposed the generaltoken record to the REST web services API. General tokens represent credentials retained from processing alternative (non-card) payment methods — typically created automatically by gateway integrations during tokenization flows.

The record is not a subrecord and has no subrecords of its own.

Record details

• Record ID: generaltoken
• REST endpoint: /services/rest/record/v1/generalToken
• Supported operations: POST (create), PATCH (update) — check the REST API Browser for the full list of supported HTTP methods.

Key fields (from the code samples)

• entity — reference to the customer record (by internal ID)
• isDefault — boolean
• paymentMethod — reference by ID
• preserveOnFile — boolean, controls whether the token is kept on file
• token — the token string itself
• tokenExpirationDate — format YYYY-MM
• tokenFamily — reference by ID
• tokenNamespace — string identifier for the token namespace
• supportedOperations.items — array of operation objects (e.g., {"id": "CREDIT"})
• memo — free-text memo field

Code samples

Create a general token (POST):

POST /services/rest/record/v1/generalToken

Body includes entity, paymentMethod, token, tokenExpirationDate, tokenFamily, tokenNamespace, supportedOperations, and optional flags like isDefault and preserveOnFile.

Update a general token (PATCH):

PATCH /services/rest/record/v1/generalToken/<id>

Partial update — send only the fields you want to change (e.g., memo).

Prerequisites

1. Enable the Payment Instruments feature.
2. Enable the Credit Card Payments feature (required even though general tokens cover non-card methods).

What to do

1. Feature check: Confirm both Payment Instruments and Credit Card Payments features are enabled in your account at Setup > Company > Enable Features.
2. Review the REST API Browser: The release note is light on the full field list and supported HTTP methods. Consult the REST API Browser's generaltoken reference page for the complete schema, required vs. optional fields, and any query parameters.
3. Integration updates: If you currently manage non-card payment tokens through SuiteScript or SOAP web services, you can now use the REST endpoint. Evaluate whether migrating token CRUD operations to REST simplifies your integration.
4. SuiteScript interplay: The source does not clarify whether generaltoken is also newly available via N/record or was already scriptable. Verify in your account by attempting record.load({ type: 'generaltoken', id: <id> }) if you need SuiteScript access alongside REST.
5. Security note: Token values are sensitive payment credentials. Ensure any integrations calling this endpoint use OAuth 2.0 or TBA with appropriately scoped roles, and avoid logging raw token strings.