HTTP, JSON, REST, webhooks and authentication

The web concepts behind every integration: requests and responses, JSON, REST conventions, webhooks, and authentication methods.

In this lesson

HTTP requests, responses and status codes
JSON, REST and webhooks
Authentication and secrets

Key points

Method, URL, headers, body → status, headers, body
2xx ok, 4xx client errors (401/403/404/409/429), 5xx server/gateway
REST resources, pagination, rate limits; webhooks need signature checks
API keys, Basic, OAuth 2.0; Odoo user API keys; never hard-code secrets

Real-world example

A payment provider's webhooks to Odoo returned 403 for a week; orders stayed unpaid. The request log showed the provider calling an old URL after a domain change and Odoo's website redirecting to login. Updating the webhook URL and verifying signatures fixed it, and a monitor on 'unpaid orders older than 1 hour' now catches it in minutes.

Questions and answers

What's the difference between 401 and 403?

401: not authenticated; 403: authenticated but not allowed.

Where can an Odoo user create an API key?

Preferences → Account Security → API keys.

Read the full lesson, worked example and quiz