REST API Pro
Secure API Keys
Generate Bearer tokens per user and limit token access to selected Odoo model rules.
Model Rules
Enable search, read, create, update, delete, field whitelist, max limit, and optional domain filter per model.
Modern API Docs
Expose Swagger, Scalar, ReDoc, OpenAPI JSON, and Postman collection routes for developers.
XML or JSON
Return JSON by default or XML with ?format=xml / XML accept headers.
Method Whitelist
Call selected Odoo model methods only when explicitly allowed in model rules.
PDF Report API
Render QWeb PDF reports and receive base64 output for external systems.
REST API Setup Flow
Configure user access, model rules, and API keys from Odoo backend.
User Access Groups
Assign REST API Manager for administrators or REST API User for token users. Manager access can be granted without forcing the User checkbox.
Model Rule Permissions
Enable only the operations required per model: search, read, fields, create, write, delete, method calls, reports, and allowed fields.
Token Generation
Generate secure API tokens per user. The token is shown once, can be restricted by model rules, and can be revoked anytime.
REST API Routes
Use standard HTTP methods to work with selected Odoo models.GET /sm_rest_api/1.0/common/version
GET /sm_rest_api/1.0/models
GET /sm_rest_api/1.0/object/{model}/fields
GET /sm_rest_api/1.0/object/{model}/search
POST /sm_rest_api/1.0/object/{model}/search
GET /sm_rest_api/1.0/object/{model}/search_count
GET /sm_rest_api/1.0/object/{model}/check_access_rights
GET /sm_rest_api/1.0/object/{model}?ids=1,2,3
GET /sm_rest_api/1.0/object/{model}/{id}
POST /sm_rest_api/1.0/object/{model}
PUT /sm_rest_api/1.0/object/{model}/{id}
PUT /sm_rest_api/1.0/object/{model}
DELETE /sm_rest_api/1.0/object/{model}/{id}
DELETE /sm_rest_api/1.0/object/{model}
POST /sm_rest_api/1.0/object/{model}/call/{method}
GET /sm_rest_api/1.0/report/{report_name}/{ids}
Swagger, Scalar, ReDoc
Developer-friendly API docs generated from active model rules.Swagger UI
/sm_rest_api/docs
Scalar UI
/sm_rest_api/docs/scalar
ReDoc UI
/sm_rest_api/docs/redoc
Postman
/sm_rest_api/postman.json
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Lines of code | 989 |
| Technical Name |
sm_rest_api_pro |
| License | OPL-1 |
| Website | https://apps.odoo.com/apps/modules/browse?author=Steven Marp |
REST API Pro
REST API Pro exposes selected Odoo models through API key protected HTTP routes. Configure model rules, generate API keys, then access documentation at /sm_rest_api/docs.
Main features:
- API key authentication through Bearer token, X-API-Key, or query key.
- Per-model operation rules for search, read, create, update, delete, fields, whitelisted method calls, and reports.
- Field whitelist, domain filter, and maximum result limit.
- JSON response by default and XML response with ?format=xml or XML accept headers.
- Swagger UI, Scalar UI, ReDoc UI, OpenAPI JSON, and Postman collection export.
More than Swagger
REST API Pro is not limited to Swagger UI. Buyers can use multiple API documentation and integration formats from the same OpenAPI schema:
- Swagger UI: /sm_rest_api/docs
- Scalar UI: /sm_rest_api/docs/scalar
- ReDoc UI: /sm_rest_api/docs/redoc
- OpenAPI JSON: /sm_rest_api/openapi.json
- Postman collection: /sm_rest_api/postman.json
This makes the API easier to test from browser docs, API clients, Postman, and external integration tools.
License
This module is released under the Odoo Proprietary License v1.0 (OPL-1). Usage is governed by Odoo Apps Store licensing terms.
End-to-End Test Guide
Use this guide after installing the module. Replace TOKEN with a newly generated API token from REST API Pro > API Keys.
Basic setup
- Give the integration user either REST API User or REST API Manager.
- Create an API key and copy the generated token.
- Create a model rule for Contact (res.partner).
- Enable Allow Search, Allow Read, Allow Fields, Allow Create, Allow Write, and Allow Delete for full CRUD testing.
Version check
This public endpoint confirms that the REST API controller is reachable.
curl -sS http://localhost:8444/sm_rest_api/1.0/common/version
Expected result:
{"success": true, "data": {"server": "SM REST API Pro", "version": "1.0", "odoo": "18.0.1.3"}}
Enabled models
This endpoint lists model rules enabled for REST access.
curl -sS -H "Authorization: Bearer TOKEN" \ http://localhost:8444/sm_rest_api/1.0/models
Expected result:
{"success": true, "data": [{"model": "res.partner", "name": "Contact", "operations": {"search": true, "read": true, "fields": true, "create": true, "write": true, "delete": true}, "max_limit": 100}]}
Search records with GET
This endpoint searches records with query parameters.
curl -sS -H "Authorization: Bearer TOKEN" \ "http://localhost:8444/sm_rest_api/1.0/object/res.partner/search?fields=id,name,email&limit=3"
Expected result:
{"success": true, "data": {"count": 92, "records": [{"id": 21662, "name": "08123456789", "email": false}, {"id": 47, "name": "Abigail Peterson", "email": "abigail.peterson39@example.com"}, {"id": 321677, "name": "Aditya Nugraha", "email": "aditya@example.com"}]}}
Search records with POST
This endpoint searches records with a JSON body. Use it for complex domains.
curl -sS -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"domain":[["name","ilike","a"]],"fields":["id","name","email"],"limit":3}' \ http://localhost:8444/sm_rest_api/1.0/object/res.partner/search
Expected result:
{"success": true, "data": {"count": 60, "records": [{"id": 47, "name": "Abigail Peterson", "email": "abigail.peterson39@example.com"}, {"id": 321677, "name": "Aditya Nugraha", "email": "aditya@example.com"}, {"id": 321680, "name": "Ahmad", "email": "ahmad@example.com"}]}}
Read multiple records
This endpoint reads selected records by IDs.
curl -sS -H "Authorization: Bearer TOKEN" \ "http://localhost:8444/sm_rest_api/1.0/object/res.partner?ids=1,2,3&fields=id,name"
Expected result:
{"success": true, "data": {"count": 3, "records": [{"id": 1, "name": "My Company (San Francisco)"}, {"id": 2, "name": "OdooBot"}, {"id": 3, "name": "Mitchell Admin"}]}}
Count records
This endpoint returns count only.
curl -sS -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"domain":[]}' \ http://localhost:8444/sm_rest_api/1.0/object/res.partner/search_count
Expected result:
{"success": true, "data": {"count": 92}}
XML response
Add format=xml when the external system needs XML instead of JSON.
curl -sS -H "Authorization: Bearer TOKEN" \ "http://localhost:8444/sm_rest_api/1.0/object/res.partner/search?fields=id,name&limit=1&format=xml"
Expected result:
<?xml version='1.0' encoding='utf-8'?> <response><success>True</success><data><count>92</count><records><item><id>21662</id><name>08123456789</name></item></records></data></response>
Access rights check
This endpoint checks whether the token user has access for a model operation.
curl -sS -H "Authorization: Bearer TOKEN" \ "http://localhost:8444/sm_rest_api/1.0/object/res.partner/check_access_rights?operation=read"
Expected result:
{"success": true, "data": {"operation": "read", "allowed": true}}
Create record
This endpoint creates a record. Allow Create must be enabled on the model rule.
curl -sS -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"values":{"name":"REST API Test Partner","email":"rest-test@example.com"}}' \ http://localhost:8444/sm_rest_api/1.0/object/res.partner
Expected result:
{"success": true, "data": {"id": 321720}}
Update record
This endpoint updates one record. Replace 321720 with the created record ID. Allow Write must be enabled on the model rule.
curl -sS -X PUT \ -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"values":{"email":"updated-rest-test@example.com"}}' \ http://localhost:8444/sm_rest_api/1.0/object/res.partner/321720
Expected result:
{"success": true, "data": {"id": 321720, "updated": true}}
Delete record
This endpoint deletes one record. Replace 321720 with the created record ID. Allow Delete must be enabled on the model rule.
curl -sS -X DELETE \ -H "Authorization: Bearer TOKEN" \ http://localhost:8444/sm_rest_api/1.0/object/res.partner/321720
Expected result:
{"success": true, "data": {"id": 321720, "deleted": true}}
Whitelisted method call
This endpoint calls a model method only when the method is explicitly allowed. For this test, enable Allow Method and set Allowed Method Names to get_metadata on the Contact model rule.
curl -sS -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"ids":[1]}' \ http://localhost:8444/sm_rest_api/1.0/object/res.partner/call/get_metadata
If the method is not whitelisted, expected protection result:
{"success": false, "error": {"message": "Method get_metadata is not allowed for model res.partner.", "type": "AccessError"}}
After whitelisting, expected result contains record metadata.
Report search and PDF export
Create a second model rule for Journal Entry (account.move) and enable Allow Search, Allow Read, Allow Fields, and Allow Report.
Search one accounting move:
curl -sS -H "Authorization: Bearer TOKEN" \ "http://localhost:8444/sm_rest_api/1.0/object/account.move/search?fields=id,name&limit=1"
Expected result:
{"success": true, "data": {"count": 60, "records": [{"id": 59, "name": "BILL/2026/06/0003"}]}}
Render PDF report as base64:
curl -sS -H "Authorization: Bearer TOKEN" \ http://localhost:8444/sm_rest_api/1.0/report/account.report_invoice_with_payments/59
Expected result contains:
{"success": true, "data": {"content_type": "pdf", "content_base64": "JVBERi0..."}}
Short alias route
The module also supports the shorter /restapi route alias.
curl -sS -H "Authorization: Bearer TOKEN" \ "http://localhost:8444/restapi/1.0/object/res.partner/search?fields=id,name&limit=1"
Expected result:
{"success": true, "data": {"count": 93, "records": [{"id": 21662, "name": "08123456789"}]}}
Token revoke test
After clicking Revoke on the API key form, the same token must stop working.
curl -sS -H "Authorization: Bearer TOKEN" \ http://localhost:8444/sm_rest_api/1.0/models
Expected result:
{"success": false, "error": {"message": "Invalid API token.", "type": "AccessError"}}
Common mistakes
Missing Bearer prefix:
curl -sS -H "Authorization: TOKEN" \ "http://localhost:8444/sm_rest_api/1.0/object/res.partner/1?fields=id,name,email"
Expected result:
{"success": false, "error": {"message": "Missing API token.", "type": "AccessError"}}
Using placeholder text instead of a real ID:
curl -sS -X PUT \ -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"values":{"email":"updated-rest-test@example.com"}}' \ http://localhost:8444/sm_rest_api/1.0/object/res.partner/ID_HASIL_CREATE
Expected result:
{"success": false, "error": {"message": "Unknown model: res.partner/ID_HASIL_CREATE", "type": "ValidationError"}}
Model rule not enabled:
{"success": false, "error": {"message": "Model is not enabled for REST API: account.move", "type": "AccessError"}}
This means the buyer must create a model rule for that model before using the endpoint.
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module