Controllers and HTTP routes

http.Controller routes, type http vs json, auth modes, website pages, returning JSON, CSRF and status codes.

In this lesson

Routes, types and auth
request.env, public users and CSRF
Webhook endpoints done properly

Key points

@http.route(path, type, auth, methods, website, csrf)
type http for pages/JSON responses; json/jsonrpc for client RPC
auth user/public/none; request.env per user
Webhooks: verify HMAC, idempotency key, status codes, respond fast, defer heavy work

Real-world example

A payment provider retried webhooks on timeouts, and every retry created another payment. Storing the provider's event ID on the payment with a unique constraint, returning 200 for duplicates and moving reconciliation to a triggered cron ended double payments.

Questions and answers

Which helper returns a JSON body from an http route?

request.make_json_response(data, status=...).

Why disable CSRF on webhooks?

External systems can't send Odoo's CSRF token; verify signatures instead.

Read the full lesson, worked example and quiz