Dependencies

• base, mail, web (all ship with Odoo 18)

No external services required. No internet connection needed at runtime.

Step 1 — Open the wizard

Navigate to API Resources → Create API. A 3-step wizard opens.

Step 2 — Configure the resource

• Model: pick res.partner
• Operations: toggle List, Get by ID, Create
• Authentication: choose API Key
• Click Create Resource

The URL path is auto-generated as /api/res_partner.

Step 3 — Generate an API key

Go to API Keys → New. Give it a name, assign a user, pick scopes (read, write, delete), and click Generate Key. The raw key is shown once — copy it immediately.

Step 4 — Call your API

# List partners
curl https://your-odoo.example.com/api/res_partner \
  -H "Authorization: Bearer sk_..."

# Get one
curl https://your-odoo.example.com/api/res_partner/42 \
  -H "Authorization: Bearer sk_..."

# Create
curl -X POST https://your-odoo.example.com/api/res_partner \
  -H "Authorization: Bearer sk_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "Acme Inc.", "email": "info@acme.example"}'

Session tokens (password grant)

Exchange an Odoo login for a bearer token:

curl -X POST https://your-odoo.example.com/api/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "password",
    "login": "user@example.com",
    "password": "..."
  }'

Response (200):

{
  "access_token": "st_kXpqY...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "user_id": 42
}

Revoke a session token:

curl -X POST https://your-odoo.example.com/api/auth/revoke \
  -H "Authorization: Bearer st_kXpqY..."

OAuth2 provider

Supported grant types:

• Authorization Code + PKCE — for mobile apps and SPAs
• Client Credentials — for server-to-server
• Refresh Token — transparent token renewal

Authorization endpoint: /oauth/authorize Token endpoint: /oauth/token

Configure applications at Configuration → OAuth2 Applications.

Mobile Sales App

• auth_method=session_token, read-only resource
• domain=[('is_company', '=', True)]
• Mobile app calls POST /api/auth/token to login, then lists customers

No-Code Automation Tool Integration

• auth_method=api_key, create-only resource (op_list=False, op_get=False)
• API key scope = write only (cannot read or delete)
• External form trigger -> automation tool -> POST /api/leads

BI Dashboard

• auth_method=api_key, op_list=True, all other ops = False
• Field whitelist: ['id', 'name', 'amount_total', 'date_order', 'state']
• Rate limit: 60 requests/minute per key

IoT Device Telemetry

• API key with user_id=False (service account)
• IP whitelist: 127.0.0.1, 10.0.0.0/8
• Factory gateway posts sensor readings every 30 seconds

Public Product Catalog

• auth_method=public, list + detail only
• domain=[('sale_ok', '=', True)]
• CORS: * (or specific frontend domain)

Admin Tool with Scope Gating

• Full CRUD resource with auth_method=api_key
• Two keys issued: one with delete scope, one without
• Same endpoint, different permission surface per key

18.0.2.0.0 (2026-04)

• NEW: api.resource model — no-code REST builder (replaces per-method api.endpoint)
• NEW: Session tokens — POST /api/auth/token password grant
• NEW: Scope enforcement — read/write/delete as Boolean gates on keys & tokens
• NEW: Resource wizard — 3-step quick setup dialog
• CHANGED: API key UI — scope checkboxes replace free-text scopes field
• CHANGED: All strings now English with Indonesian translation
• Legacy api.endpoint records still supported (backward-compatible)

18.0.1.3.0 (2026-02)

• OAuth2 provider with Authorization Code + PKCE, Client Credentials
• API key management with rotation
• Rate limiting (sliding window)
• Webhook manager with retry & HMAC