How to Use RPC Calls in Odoo 18

In terms of Odoo Development, Remote Procedure Call provides an efficient means of communication between the frontend and the backend. This provides for making calls to methods on the server-side as well as accessing and processing data without having to refresh the webpage.

Odoo has the capability of implementing various RPC methods, including XML-RPC and JSON-RPC. Currently, in terms of Odoo frontend development, particularly for OWL and JavaScript elements, there is an inbuilt functionality that allows RPC communications to the Odoo backend.

This article explains the process of implementing JSON-RPC communication in Odoo 18. This also provides an explanation of how to make RPC calls from the frontend and implement JSON controllers.

Understanding JSON-RPC

JSON-RPC is a stateless/light-weight remote procedure call protocol that uses JSON for making requests and responses from the client to the server.

In Odoo, the use of RPC occurs whenever there is interaction between the frontend and the model/controllers methods of the backend part. For example, a JavaScript component can ask for customer data, create a new entry, update entries, or call custom methods defined in Python.

When it comes to modern Odoo frontends, the RPC service provided by Odoo can be used via OWL components.

Why Use JSON-RPC in Odoo?

JSON-RPC is useful when frontend JavaScript needs to communicate with Odoo's server-side logic using JSON-based requests. It allows an OWL component or other frontend code to retrieve data, call backend methods, or send information to a custom controller without requiring a full page reload.

Common use cases include:

• Retrieving records from Odoo models.
• Calling server-side model methods from JavaScript.
• Creating or updating records through backend methods.
• Loading dynamic data into OWL components.
• Sending data from a website or custom frontend to a JSON controller.
• Executing custom business logic on the Odoo server.
• Building dynamic forms and interactive frontend features.

For example, an OWL component can make a JSON-based RPC request during its initialization, receive the response from the Odoo backend, and use the returned data to update the component's interface.

When Should You Use a Custom Controller?

A custom controller is useful when the required operation does not map cleanly to a single model method or when you want to expose a dedicated endpoint.

For example, a custom controller can:

1. Receive several parameters from the frontend.
2. Validate the input.
3. Perform multiple backend operations.
4. Apply business logic.
5. Return a structured result to the frontend.

This can make complex frontend/backend interactions easier to maintain.

However, controllers should not be used simply to bypass Odoo's access-control mechanisms. Backend operations should always be performed with the appropriate security checks.

Making RPC Calls from the Odoo Frontend: A Step-by-Step Guide

We can use the built-in RPC service for customisation of frontend components using owl/js

Step 1: Import the RPC Service

/** @odoo-module **/
import { rpc } from "@web/core/network/rpc";
// ... other imports

Step 2: Calling the RPC Method

Below is an example of using the rpc function for sending requests to the Odoo Backend.

import { Component, onWillStart, useState } from "@odoo/owl";
export class MyRpcComponent extends Component {
   setup() {
       this.state = useState({ partners: [] });
       onWillStart(async () => {
           // Call the standard model method (search_read)
           this.state.partners = await rpc("/web/dataset/call_kw", {
               model: 'res.partner',
               method: 'search_read',
               args: [[]], // Domain filter
               kwargs: { fields: ['name', 'email'], limit: 5 }
           });
           console.log("Client-side RPC Result:", this.state.partners);
       });
   }
}

Creating JSON-RPC Controllers in Odoo 18

Step 1: Import Necessary Modules

Import the required modules to start using JSON-RPC.

from odoo import http

Step 2: Implement JSON-RPC in Your Controller

Create a new controller or update an existing controller to use JSON-RPC. For example:

class SampleController(http.Controller):
   @http.route('/sample/rpc/endpoint', type='json', auth='public', website=True)
   def sample_rpc_method(self, param1, param2):
       # Your JSON-RPC logic here
       return result

Step 3: Call It from the Frontend

Use the rpc service to call the endpoint. The keys in the payload map directly to the Python method's parameters:

this.state.result = await rpc("/sample/rpc/endpoint", {
    param1: "value1",
    param2: "value2"
});

Error Handling for JSON-RPC Calls

If the server raises an exception, the RPC promise is rejected — even though Odoo still returns HTTP 200 and embeds the error inside the JSON body. Wrapping the call in try/catch prevents your component from breaking silently and lets you surface a meaningful message to the user:

try {
    this.state.result = await rpc("/sample/rpc/endpoint", {
        param1: "value1",
        param2: "value2"
    });
} catch (error) {
    // error.data.name contains the exception class, e.g. "odoo.exceptions.ValidationError"
    console.error("RPC call failed:", error);
}

Understanding auth= in JSON-RPC Controllers

@http.route’s auth parameter controls two aspects of the endpoint simultaneously: who can access it and which user the logic in your controller is executed by. Incorrect choice of the value is one of the most frequent errors when it comes to securing your Odoo module.

auth='public' doesn't imply "no restrictions". The public is a shared user with limited permissions, and everything goes through the Odoo Access Control List and Record Rules. To run some functionality requiring elevated access rights on the public endpoint, you have to invoke .sudo(), and thus disable any security checks – a very dangerous approach to take.

auth='user’ is the correct choice for endpoints that should only be accessible to authenticated users. Odoo executes the controller method in the authenticated user's session and applies the relevant access rights and record rules. For JSON routes (type='json'), an unauthenticated request returns a session-expired error (code 100). For HTTP routes (type='http'), it redirects to the login page.

auth='none' gives you no access to the database. It is meant for framework-level endpoints that have to work even if the database context isn't available yet. You are not able to read/write any record from the endpoint with the auth='none' parameter.

JSON-RPC in Odoo 18 is an efficient and up-to-date solution for client-server interaction. Taking advantage of the internal RPC system in the front end and creating good-quality controllers in the back end will help to develop flexible applications with a great user experience.

• JSON-RPC is recommended to be used for the RPC calls in Odoo 18
• Use rpc() from @web/core/network/rpc for the frontend calls
• Develop controllers with type='json' for the backend
• Always apply error handling and security procedures.

To read more about How to Call JSON RPC to Webcontroller in Odoo18, refer to our blog, How to Call JSON RPC to Webcontroller in Odoo18.