Over-privileged connections
External systems log in as an admin with a shared password, so a leaked credential exposes the entire database.
Odoo ERP · API integration
Odoo API integration engineered for real traffic, not just a demo call
Reading a partner record over XML-RPC takes a few lines of code. Syncing thousands of orders a day without duplicates, timeouts or security holes takes design. That design is what we deliver.
What is Odoo API Integration?
Odoo API integration is the technical work of letting external software read and write Odoo data programmatically, using Odoo's external API (the JSON-2 API on Odoo 19 and later, XML-RPC or JSON-RPC on earlier versions), webhook triggers, or custom HTTP endpoints written as Odoo controllers. It covers authentication, which models and methods are called, how data is batched and paginated, how errors and retries are handled, and how the integration behaves under load. It is the engineering layer beneath any business-level Odoo integration.
Odoo's external API is powerful because it exposes the ORM directly: any model, any method the calling user is allowed to use. That flexibility is also the risk. Integrations built quickly often authenticate as an administrator, call write() one record at a time, poll the whole table every minute and have no idea what to do when a call fails halfway. They work in testing and fall over in production. A deliberate API design avoids those failure modes before they reach your data.
Where Odoo API work goes wrong
Chatty, slow integrations
One API call per record and repeated full-table reads put load on Odoo workers and make syncs take hours.
No clean contract for partners
Third parties need a stable, documented endpoint, but the raw ORM API changes shape as Odoo models evolve between versions.
Silent partial failures
A batch fails halfway, nothing is logged, and records end up existing in one system but not the other.
Our Odoo API Integration service
API architecture and design
Choice between the external RPC API, webhooks and custom endpoints for each flow, with data contracts, sync direction and frequency documented.
External API clients
Clients in Python, Node.js or PHP that call Odoo's JSON-2 API, or XML-RPC and JSON-RPC on older versions, using search_read, create, write and custom methods, with batching and pagination.
Custom REST controllers
Purpose-built HTTP endpoints inside an Odoo module that expose a stable JSON contract to partners, mobile apps or websites, independent of internal model changes.
Webhooks and event-driven sync
Outgoing notifications when records change and incoming webhook handlers for events from payment, shipping or commerce platforms.
Authentication and access design
Dedicated integration users, API keys, token-based authentication for custom endpoints and access rights scoped to exactly what each client needs.
Reliability engineering
Idempotency through external IDs, retries with back-off, queueing of heavy work, structured logging and alerting on failures.
Included capabilities
- JSON-2, XML-RPC and JSON-RPC clients
- search_read with field selection
- Batched create and write calls
- Custom JSON endpoints
- Incoming and outgoing webhooks
- API key authentication
- External ID mapping
- Rate limiting and retries
- Request and error logging
- API documentation for consumers
What Odoo API Integration changes for your business
Stable integration contracts
Custom endpoints shield external clients from internal Odoo model changes across versions.
Lower load on Odoo
Batching, field selection and incremental sync keep API traffic from slowing down users.
Reduced blast radius
Scoped integration users mean a compromised key exposes only what that integration needs.
Traceable data flows
Every call and failure is logged, so discrepancies can be traced to a specific request.
Where it makes the biggest difference
Mobile app on top of Odoo
A field sales app reads products and pricelists and creates orders through custom endpoints that return only the fields the app needs.
Partner order API
Wholesale customers submit orders from their own systems to a documented endpoint that validates them before creating sales orders.
Reporting export
Invoices and stock moves are extracted incrementally by write date into a data warehouse for analytics.
Event-driven fulfillment
A confirmed delivery in Odoo triggers a webhook to a logistics platform, which calls back with tracking details.
How we build an API integration
Contracts and access are agreed first; load testing happens before production, not after.
Define contracts
Agree the data each side sends and receives, in which format, and how often.
Pick the interface
Choose the RPC API, webhooks or a custom controller per flow, based on volume and stability needs.
Secure access
Create integration users, API keys and access rights limited to the required models.
Build
Develop the client or endpoint with batching, validation and idempotent writes.
Load test
Exercise the integration with realistic volumes on staging and tune worker and query behavior.
Deploy and monitor
Release with logging and alerts so failures are noticed quickly, not weeks later.
What it connects to
Odoo API Integration
- Mobile apps
- Customer and dealer portals
- Payment and shipping platforms
- eCommerce storefronts
- Data warehouses and BI tools
- Legacy and in-house systems
- AI and document-processing services
Built with
Choosing an Odoo API approach
| Criterion | External API (XML-RPC / JSON-RPC) | Webhooks | Custom REST controller |
|---|---|---|---|
| Best for | Internal tools, scripts, data sync | Reacting to events quickly | Stable contracts for partners and apps |
| Needs a custom module | No | Sometimes | Yes |
| Data shape | Odoo models as they are | Event payload | Designed for the consumer |
| Available on Odoo Online | Depends on subscription plan | Via automation rules in recent versions | No (custom code not allowed) |
Security, quality and scale
API keys over passwords
Integrations authenticate with revocable API keys tied to dedicated users, not shared login passwords.
Input validation
Custom endpoints validate payloads and enforce access rights instead of running everything as superuser.
Transport security
All traffic over HTTPS, with webhook signatures or shared secrets verified on incoming calls.
Throughput planning
Worker counts, timeouts and request sizes configured for expected API volume alongside interactive users.
What working with us looks like
We design for failure
Every integration answers the question of what happens when a call fails halfway, before it goes live.
Both ends of the wire
We build the Odoo side and the consuming application, whether that's a mobile app, a portal or a Node.js service.
Version-aware
We account for API differences between Odoo versions, including the JSON-2 API introduced in Odoo 19 that is replacing the older RPC endpoints.
Documentation for your partners
Custom endpoints come with clear API documentation so third parties can integrate without guesswork.
What it costs
Fixed-price packages with the scope written down, paid stage by stage. Your project goes live once it's fully paid.
Related services, technologies and industries
Sources and further reading
Official documentation and guidance if you want to read more about this topic.
Odoo API Integration: questions we hear most
Does Odoo have a REST API?
Not a conventional one. Up to Odoo 18 the built-in external API uses XML-RPC and JSON-RPC; Odoo 19 adds a JSON-2 API over plain HTTP with API keys, but it still mirrors Odoo's models and methods rather than a resource-style REST design. When a REST-style interface is needed, it is built as custom HTTP controllers inside an Odoo module, which lets you define clean URLs and JSON payloads.
How do external applications authenticate with Odoo?
External applications authenticate with a user login and either a password or, preferably, an API key generated for that user. Custom endpoints can add their own token schemes, and access is always limited by the user's access rights.
Can Odoo send webhooks when records change?
Yes, recent Odoo versions can send webhook notifications from automation rules, and custom modules can send them in any version. Incoming webhooks from other platforms are handled by custom controllers or, in recent versions, webhook-triggered automation rules.
Will heavy API traffic slow down Odoo for users?
It can, if calls are unbatched or poll large tables frequently. Batching, requesting only needed fields, syncing incrementally by write date and sizing workers correctly keep API load from affecting interactive users.
Does API access work on Odoo Online?
The external API is available on Odoo Online depending on your subscription plan, but custom controllers are not, since custom Python modules cannot be installed there. For custom endpoints, Odoo.sh or self-hosting is required.
How is this different from your Odoo integration service?
This page covers the technical API layer, while our Odoo integration service focuses on business connections such as stores, payment gateways and couriers. Most integration projects use both.
Next step
Share your API requirements
Tell us what needs to talk to Odoo, at what volume, and on which Odoo version. We'll recommend the interface and outline the design.