Full CRUD on any model via /api/v1/ (search, read, create, update, delete)

Auto-generated OpenAPI 3.0 / Swagger documentation at /api/v1/docs

API key management UI with key rotation, expiry, and field-level access control

Rate limiting / throttling per key or per IP

Full request audit logging with searchable log viewer

CORS support via system parameter (rest_default_cors)

Multi-database support via ?db= parameter

Pagination, sorting, and field filtering on list endpoints

Framework for custom controllers via @rest_route decorator

Professional support and documentation

Installation & Setup

1. Install the module: Go to Apps -> Search for "oe_rest_api" -> Click Install
2. Configure permissions: Navigate to Settings -> Technical -> REST API to assign API key management and audit log access to administrators
3. Initial configuration: Set the CORS origin in System Parameters (rest_default_cors) if your frontend runs on a different domain

Basic Usage

1. Generate an API key: Go to Settings -> Technical -> REST API -> API Keys and create a new key with the desired access scope
2. Explore the API: Navigate to /api/v1/docs to see the auto-generated Swagger UI with all available endpoints and models
3. Make your first call: Use curl, Postman, or any HTTP client to call GET /api/v1/res.partner with your API key in the Authorization header
4. Create custom endpoints: Use the Custom Endpoint builder in Settings to define domain-based queries, server actions, or Python code endpoints

Tips & Best Practices

• Start with API Key authentication for internal integrations - it is the simplest to configure and most performant
• Enable rate limiting early to prevent accidental abuse during development and testing
• Use the audit log to monitor which integrations are making the most calls and identify optimization opportunities
• For public-facing APIs, use OAuth2 with the Authorization Code grant for maximum security

Important Notes

The oauthlib Python package is required. Install it via pip if not already present. For production deployments, configure HTTPS and set strong rate limits. API keys grant access to the models they are scoped to - review field-level permissions carefully.

Q: Which Odoo versions and authentication methods are supported?

A: ``oe_rest_api`` targets Odoo Community and Enterprise editions. Supported authentication methods include OAuth1, OAuth2 (Authorization Code, Implicit, Resource Owner Password, Client Credentials), API Key, and Basic Auth. The module also supports multi-database routing via the ?db= query parameter.

Q: Do I need to write code to expose my custom models?

A: No. Every Odoo model is automatically available via /api/v1/ endpoints with full CRUD operations. You only need to write code if you want custom business logic endpoints, which you can build using the Settings UI custom endpoint builder or the @rest_route decorator.

Q: How does rate limiting work and can I configure it per user or per key?

A: Rate limiting can be configured per API key and per IP address. Set limits in the API key form or via system parameters. When a limit is exceeded, the API returns a 429 Too Many Requests response with a Retry-After header.

Q: Can I use this module with mobile apps or single-page applications?

A: Yes. The module supports CORS configuration via the rest_default_cors system parameter, making it suitable for SPAs, mobile apps, and any client-side application. OAuth2 Implicit and Authorization Code grants are ideal for browser-based and mobile clients.

Why Choose Odoo Engineering