Endpoint Details

Request Body

Processing Steps

1. Validate JSON body format
2. Check required fields (name)
3. Filter writable fields from request
4. Create product.template record in database
5. Serialize response using PRODUCT_FIELDS whitelist
6. Log request to api.log
7. Return JSON response with created product data

Response

{
  "success": true,
  "data": {
    "id": 1,
    "name": "Example Product",
    "default_code": "PROD001",
    "list_price": 99.99,
    "categ_id": {"id": 1, "name": "Electronics"},
    "active": true
  },
  "message": "Product created successfully"
}

Endpoint Details

Request Body

Order Line Structure

"order_lines": [
  {
    "product_id": 1,
    "product_qty": 5,
    "price_unit": 99.99
  }
]

Processing Steps

1. Parse JSON request body
2. Validate partner_id exists
3. Validate order_lines array
4. Validate each product exists
5. Create sale.order record
6. Create sale.order.line records for each line
7. Calculate totals and tax
8. Return order data with confirmation status

Endpoint Details

Request Body

Processing Steps

1. Validate JSON body
2. Check required name field
3. Filter writable fields
4. Create res.partner record
5. Validate email format if provided
6. Serialize response data
7. Log to audit trail
8. Return created customer record

Token Generation

1. User Login
   POST /api/v1/auth/login with email/password
2. Credential Validation
   Verify user exists and password matches
3. Token Creation
   Access token (1 hour) and refresh token (7 days) generated via PyJWT
4. Payload Encoding
   Include user ID, token type, iat, and exp claims
5. Token Response
   Return both tokens to client for storage

Token Validation on Request

1. Extract token from Authorization header
2. Decode JWT with secret key
3. Verify token type (access vs refresh)
4. Check expiration timestamp
5. Extract user ID from payload
6. Grant access if valid

Token Configuration

Key Lifecycle

1. Key Generation
   Auto-generated 64-character URL-safe token on creation
2. Key Hashing
   SHA-256 hash stored in database for security
3. Scope Assignment
   Assign permissions (products_read, products_write, etc.)
4. Rate Limiting
   Configure per-minute and per-hour limits
5. IP Whitelist
   Optionally restrict to specific IP addresses
6. Expiration Date
   Optional expiration for temporary keys

Key Validation Process

1. Extract API key from X-API-Key header
2. Compute SHA-256 hash of provided key
3. Search for matching key record
4. Check key is active (not revoked)
5. Validate expiration date
6. Load associated user and scopes
7. Grant or deny access based on scopes

Request

curl -X POST http://localhost:8069/api/v1/products \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Wireless Keyboard",
    "default_code": "KB001",
    "list_price": 79.99,
    "categ_id": 2,
    "description_sale": "Ergonomic wireless keyboard"
  }'

Response

{
  "success": true,
  "data": {
    "id": 5,
    "name": "Wireless Keyboard",
    "default_code": "KB001",
    "list_price": 79.99,
    "categ_id": {"id": 2, "name": "Peripherals"},
    "active": true,
    "qty_available": 0
  },
  "message": "Product created successfully"
}

Request

curl -X POST http://localhost:8069/api/v1/orders \
  -H "X-API-Key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "partner_id": 3,
    "order_lines": [
      {
        "product_id": 1,
        "product_qty": 2,
        "price_unit": 99.99
      },
      {
        "product_id": 5,
        "product_qty": 1,
        "price_unit": 79.99
      }
    ]
  }'

Response

{
  "success": true,
  "data": {
    "id": 10,
    "partner_id": {"id": 3, "name": "John Doe"},
    "amount_total": 259.97,
    "state": "draft",
    "order_lines": [
      {
        "id": 25,
        "product_id": {"id": 1, "name": "Mouse"},
        "qty": 2
      }
    ]
  },
  "message": "Order created successfully"
}

Request

curl -X POST http://localhost:8069/api/v1/customers \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Jane Smith",
    "email": "jane@example.com",
    "phone": "+1-555-0123",
    "street": "123 Main St",
    "country_id": 1,
    "is_company": false
  }'

Response

{
  "success": true,
  "data": {
    "id": 8,
    "name": "Jane Smith",
    "email": "jane@example.com",
    "phone": "+1-555-0123",
    "street": "123 Main St",
    "country_id": {"id": 1, "name": "Belgium"},
    "is_company": false,
    "active": true
  },
  "message": "Customer created successfully"
}

Missing Required Field

{
  "success": false,
  "error": {
    "code": 400,
    "message": "Missing required field: name"
  }
}

Invalid JSON

{
  "success": false,
  "error": {
    "code": 400,
    "message": "Invalid JSON body"
  }
}

Rate Limit Exceeded

{
  "success": false,
  "error": {
    "code": 429,
    "message": "Rate limit exceeded. Max 60 requests per minute"
  }
}