External API: XML-RPC, JSON-RPC and JSON-2

Calling Odoo from other systems: authentication, execute_kw and search_read, the newer JSON-2 API, API keys and good practice.

In this lesson

XML-RPC/JSON-RPC and execute_kw
JSON-2 API (Odoo 19+)
Integration users, batching and resilience

Key points

common.authenticate → uid; object.execute_kw(db, uid, key, model, method, args, kwargs)
Private _methods aren't callable; Online needs Custom plan
JSON-2: POST /json/2/<model>/<method> with bearer API key (19+); old RPC deprecated
Dedicated integration user, least rights, batching, retries, no tight polling

Real-world example

A logistics partner polled Odoo for new deliveries every 10 seconds with an admin password. It slowed the server and the password leaked in a log. The integration moved to a dedicated user with an API key, JSON-2 on Odoo 19, and a webhook from an automation rule on delivery validation. Load dropped and the leak was rotated.

Questions and answers

Why can't you call _compute_amount via RPC?

Methods starting with _ are private.

What header carries the API key in JSON-2?

Authorization: bearer <key>.

Read the full lesson, worked example and quiz