Odoo integrates with third-party software applications and eCommerce through the API. In addition, due to the introduction of the External JSON-2 API in Odoo v.20, there is a choice of API usage for the developer to connect to the model methods via the HTTP protocol. Furthermore, the purpose is to no longer use the XML-RPC and JSON-RPC protocols.
API provides several endpoints for the developer to choose different scopes of API keys. The developer can use dynamic documentation and a deprecation timeline as well.
Understanding Odoo 20 API Endpoints
Odoo provides a number of endpoints for external integration and controller-based communications. The choice of the end point depends on the task to be performed and authentication issues.
External JSON-2 API
The external JSON-2 API works as the best alternative to the older external models' RPC calls. The structure of the endpoint is the following:
POST /json/2/<model>/<method>
For instance, /json/2/res.partner/search_read implies that the “search_read” function of the “res.partner” model has been called. The parameters are passed in JSON format, and the process of authentication is performed using the bearer API key.
JSON-2 was introduced in Odoo 19.0, and it is included in Odoo 20. The module comes with normal Odoo access rights, rules for the loss of records, and a field access check.
The old XML-RPC and JSON-RPC interface types
These interfaces are capable of utilizing the /xmlrpc, /xmlrpc/2 and /jsonrpc URLs. These are among the many features that offer access to such standard services as common, db, and object. There are several methods in the common service used for the authentication process, but the latest one is related to the object service, allowing you to call the public methods of models of an external app using the execute_kw method.
One should bear in mind that the db service has been dropped in the Odoo 20 version. Besides, even though the common and object services were still available, they would no longer be supported in Odoo 22.
What users need to know about the /json/1 endpoint
It should be made clear that the /json/1 and /json/2 are different. The /json/1 needs to create the view-JSON. The actual features of the request and operations available can be determined only if Odoo version 20 is installed.
Understanding of the RPC Module
The RPC module is implemented in domains which deal with functionality of the usage of the RPC module in Odoo. In this way, due to the connection, it becomes installed and enabled for the whole server. Server-wide modules become enabled upon server start-up, but not during the start-up of any application that works in a particular database.
It becomes rather important when it is required to understand the routes that could be registered and implemented in the Odoo framework. It is essential for the developer to know the difference between the API for external models and the RPC in the frontend: JS could call someone through the RPC of the frontend, whereas the ORM service interacts with Odoo models.
If the user implements /json/1 and other routes related to the RPC module, it is better to examine the module itself and its configuration in order to determine possibilities of performing some actions. The presence of the endpoint is dependent on the Odoo build and its parts.
Bearer API Keys and the rpc Scope
Odoo can implement the possibility of using API keys to verify the request without requiring the user to input their password each time. JSON-2 requests are performed through a bearer token, like this:
Authorization: bearer YOUR_API_KEY
Content-Type: application/json
The rpc scope is described as the scope that is applied in the common case for accessing the RPC through controllers with auth='bearer'. Scope defines where it is possible to use API keys; however, it does not restrict the access rights to the models and record rules of Odoo.
The creation of API keys can be performed by going to Preferences > Account Security > New API Key. The key will be created only once and will be valid for 3 months starting from that moment. It is important to protect the keys in regard to the storage of keys, use of different keys for various integrations and modification of them.
For automating the processes, it is preferable to create a separate Odoo user with access rights.
Dynamic API Documentation at /doc
The /doc page was developed to enable developers to find different models, fields, and methods that are available in a certain Odoo database. This is important because the available API features depend not only on the available applications but also on the database itself.
Within the defined scope of work, the functionality is connected with the api_doc. Within the installation where this documentation can be used, developers will be able to analyze its results to understand which model and method are to be used when making an API call.
In case a certain integration retrieves customer data, it will be possible to check what methods are available for the class res.partner, what parameters it should use, and what fields it is possible to get through the API. Here, what is really important is the fact that it is better to find out what models and methods are available instead of making assumptions about their presence in every Odoo database.
Nowadays, the Dynamic Documentation part of Odoo 20 JSON-2 documentation says that it is under construction. It means that it is necessary to analyze the registration of the /doc feature within the targeted installation.
Timeline for Deprecation of XML-RPC and JSON-RPC
The migration notes of Odoo provide a distinction between the services that were discontinued and those that will be retired in the future.
- Version 20: db RPC external service was discontinued.
- Odoo 22 will be launched at some point in fall 2028: legacy common and object services will be discontinued.
- Odoo Online: Each release has its own milestone. In Online 19.1, the db service was discontinued, while common and object services will be discontinued in Online 21.1.
This information relates only to the legacy external RPC services. Custom controllers that were defined using @route(type='jsonrpc') (they used to be @route(type='json') before Odoo 18) are excluded from this notice of deprecation.
When migrating to JSON-2, users of older integrations should check their endpoints for any dependencies on the services being retired.
Selecting the Correct Endpoint for Integration
As an option for realization of a new external model, one can consider JSON-2. Parameters in JSON will be passed in HTTP requests in this case, and a Bearer API key will be used for authentication. In JSON-2, a simple request structure is implemented, which provides standard HTTP responses with JSON data.
In addition, old XML-RPC or JSON-RPC models can be implemented, as well as for those companies that are forced to work with the legacy system based on outdated common services or object services. One should be prepared for further development of implementation without XML-RPC and JSON-RPC since their lifetime is unknown.
Custom controllers should be considered in cases when it is required to implement a custom business interface rather than a common interface for modeling methods. In this case, the controller should provide appropriate authentication, authorization, validation, and error handling of requests.
The Odoo version, modules, and hosting plans should be considered to make a final decision about the endpoint. External access to the API is possible for the Odoo Custom plan but not for the One App Free or Standard plans.
There are several Odoo 20 interfaces; however, each one has a particular use, a specific authentication mechanism, and a type of support. It is suggested that JSON-2 be used as an interface to replace older external model RPC calls, while custom controllers could be used in unique integration cases.
Knowledge about rpc scope, API documentation, and its deprecation schedule helps developers pick the right endpoint and make changes to the existing integrations. By using certain criteria in regard to endpoint availability, API key security, the least privilege method, and testing migration scenarios, developers can create successful Odoo integrations.
To read more about How to Integrate Odoo 20 with Other Business Systems Using APIs and Connectors, refer to our blog, How to Integrate Odoo 20 with Other Business Systems Using APIs and Connectors.