The API Report CardAPI Index
THE API REPORT CARD / Enterprise Software / Odoo
Odoo

Odoo API

odoo.com

Odoo exposes essentially every model through public XML-RPC and JSON-RPC APIs, plus a newer JSON-2 REST API in v19 that is gated to the Custom plan. API keys are self-serve per user. Annual major releases break integrations, and there are no native webhooks.

Last verified: July 2026Enterprise Software
API GRADE
D+
VERIFIED JUL 2026

SCORECARD

ExistenceGOODXML-RPC, JSON-RPC, and the v19 JSON-2 REST API expose every model and method; a full public API surface plainly exists.
AccessGOODAPI keys are minted self-serve per user; XML-RPC and JSON-RPC work on all plans, though the new REST API needs the Custom plan.
CoverageGOODEssentially every model, field, and method is callable via XML-RPC or JSON-RPC; bulk writes must be chunked manually.
AuthPOORAPI keys are password equivalents carrying the user's full permissions; there is no OAuth flow or scoping.
Docs & DXPOOROfficial docs are version-specific and widely cited as outdated; no official SDK and no native webhook system.
StabilityPOORAnnual major releases change model fields and method signatures with no formal deprecation policy; integrations get re-coded on upgrade.
MORE FROM THE REPORT CARD
NetSuiteFAcumaticaD+Sage IntacctD+Infor CloudSuiteF
Supergood: Odoo has an API, but using it means gates, contracts, or workarounds. Ours doesn't: stable endpoints, normalized JSON, managed auth.

Frequently asked questions

Odoo scores D+ on the API Report Card. Odoo exposes essentially every model through public XML-RPC and JSON-RPC APIs, plus a newer JSON-2 REST API in v19 that is gated to the Custom plan. API keys are self-serve per user. Annual major releases break integrations, and there are no native webhooks.

Tried to integrate with Odoo?
SOURCES
The new JSON-2 REST API (v19.0) is gated behind the Custom pricing plan and is NOT available on One App Free or Standard plans, forcing many customers to fall back to XML-RPC / JSON-RPC for external integrations odoo.com ↗
No native first-party webhook system, developers must hand-roll outbound HTTP from Python Automated Actions or custom module code on each create/write/unlink event, owning all retry, replay, signature, and ordering logic themselves getknit.dev ↗
API authentication originally required cleartext username + password in every request body; API keys (introduced v14) replaced the password but are still passed as a password-equivalent rather than a true OAuth flow maesn.com ↗
XML-RPC error messages from /xmlrpc/2/object are notoriously opaque, generic 'AccessError' or 'ValidationError' without indicating which field, which record, or which security rule was violated moldstud.com ↗
Annual major version releases (v17 → v18 → v19) routinely change model fields, method signatures, and security rules, every integration must be re-tested and often re-coded on upgrade, with no formal deprecation policy on external API surfaces erpresearch.com ↗
No native rate limiting on the API means abusive clients can overwhelm shared-tenant Odoo Online / Odoo.sh instances; conversely, infrastructure-level throttling on Odoo.sh returns HTTP 503/429 without descriptive headers, leaving developers to guess the limits ecosire.com ↗
Documentation for the external API is version-specific and often shallow, many model methods (especially the dozens of business-logic methods on account.move, stock.picking, sale.order) are documented only by reading Python source on GitHub odoo.com ↗
Third-party community modules from the 40,000+ app store add custom fields, models, and method overrides that are not documented in the standard API reference, integration partners must inspect each customer database to discover its actual schema oec.sh ↗
Bulk operations require manual chunking, read() and write() with very large id arrays time out, and there is no native bulk-import endpoint comparable to Salesforce Bulk API or NetSuite's import APIs getknit.dev ↗
Session-based JSON-RPC authentication via /web/session/authenticate uses cookies that expire and must be refreshed, which is awkward for long-running server-to-server integrations vs. modern OAuth 2.0 refresh-token flows postman.com ↗
The Owl-based long-polling 'bus' that powers Discuss / live chat is not a supported public event stream, partners who want near-real-time change notifications must poll the API or write a custom module that posts to a webhook target ecosire.com ↗
Implementation partner quality varies wildly, many Odoo Silver/Gold partners oversell scope and underestimate complexity, leading to abandoned projects and wasted budget when clients do not have in-house Odoo expertise ventor.tech ↗
Documentation is widely cited as outdated relative to the current release; tutorials and forum answers often reference v12–v15 behavior that has changed in v17–v19, forcing developers to dig through source code ventor.tech ↗
Customer support is gated behind a paid Success Pack or partner relationship; even simple frontend customization questions get routed to 'talk to your account manager' rather than being resolved ventor.tech ↗
The annual major release cycle (v17 → v18 → v19) regularly breaks custom modules, third-party app store apps, and bespoke integrations; upgrade projects are themselves multi-month and expensive erpresearch.com ↗
The 'free' Community edition is functionally limited, Studio, accounting in some markets, multi-company, MRP scheduling, and the mobile apps are Enterprise-only, so the real cost is closer to Enterprise pricing for any serious use order.co ↗
The 40,000+ community app store is uncurated; many apps are abandoned, work only on specific versions, or contain low-quality code that conflicts with first-party modules g2.com ↗
Performance degrades on large databases (millions of records) and on heavy concurrent web/POS load, requiring sharding, read replicas, or moving to Odoo.sh's larger tiers ventor.tech ↗
End-user adoption is challenging because the UI exposes too many modules and fields by default; new users find the breadth overwhelming compared to single-purpose tools ventor.tech ↗
Pricing recently shifted to a single all-app price (~$24.90/user/month) which is simpler but eliminates the older a-la-carte option of buying only one or two apps cheaply odoo.com ↗
Reporting outside of basic list/pivot views requires the Spreadsheet or Studio modules (Enterprise-only) or external BI (Metabase, Tableau, Power BI) connected to PostgreSQL directly, bypassing the API bitrix24.com ↗
© Supergood Systems, Inc.