Contact Book a call

Databases and operations

Odoo integration consultant: connecting Odoo and moving to JSON-2.

Odoo has deprecated its XML-RPC and JSON-RPC endpoints in favour of the External JSON-2 API, and external API access depends on your plan. SBD checks both, connects Odoo to your CRM, shop and finance tools, and moves older integrations across before the endpoints are removed, for teams of 5 to 1,000 people.

Tool
odoo.com
Usually paired with
n8n, Make, Shopify, HubSpot
Timeline
Most builds live in 3 to 5 business days from scope
Owned by
You, with accounts, credentials and code in your name.

What we build on Odoo

  • Confirm your plan and version allow external API access
  • Connect Odoo to shops, CRMs and finance tools
  • Move XML-RPC and JSON-RPC integrations to JSON-2
  • Set up bot users, key rotation and failure alerts

What we sync

  • Sales orders
  • Products
  • Stock
  • Invoices
  • Contacts

Workflows we are asked for

  • Shopify orders to Odoo sales orders
  • HubSpot deal to Odoo quotation
  • Odoo stock levels to a sales channel
  • XML-RPC script migrated to JSON-2

Often paired with

Tools Odoo usually needs to talk to.

API changes

The XML-RPC and JSON-RPC removal dates

Odoo's External RPC API documentation, read in November 2026, says the /xmlrpc, /xmlrpc/2 and /jsonrpc endpoints are deprecated and names External JSON-2 as the replacement. The db service is listed as removed in Odoo 20 (autumn 2026) and Online 19.1 (winter 2025). The common and object services are scheduled for removal in Odoo 22 (autumn 2028) and Online 21.1 (winter 2027).

Note the gap between those last two dates. A company on Odoo Online reaches the removal earlier than one on a self-hosted version. Scripts and connectors using the old endpoints keep working until then, and a version upgrade is the moment they stop.

Odoo's 19.0 developer documentation describes JSON-2. The 18.0 external API page we read describes XML-RPC only, so a company on an older version has to plan the upgrade and the integration change together.

Plans

External API access depends on your Odoo plan

Odoo's documentation, read in November 2026, says access to data through the external API is only available on Custom plans, and is not available on One App Free or Standard. Its pricing page agrees, and notes that calls Odoo itself makes to services such as payment providers and carriers are part of the standard plan. Custom is also the plan that allows Odoo.sh or on-premise hosting.

We check this first, because a company on Standard cannot connect outside software to Odoo's data until it changes plan. The per-user cost of that change belongs in your budget for the project. Odoo shows prices by region, so we read yours rather than quote one here.

What changes

What moving to JSON-2 involves

The change is more than a new address, because several behaviours differ. These points come from Odoo's 19.0 documentation, read in November 2026:

  • Requests are JSON posts to a model and method URL under /json/2/, with arguments passed by name.
  • An API key travels as a bearer token in the Authorization header, and the database goes in an X-Odoo-Database header when needed.
  • Keys cannot last longer than three months, so an integration needs a rotation routine and an owner for it.
  • Each call runs in its own SQL transaction and calls cannot be chained into one, so multi-step writes need a plan for partial failure.
  • Odoo's own access rights apply, and the documentation recommends dedicated bot users over personal accounts.

What we do

What an Odoo project from SBD covers

We connect Odoo to other systems. Orders from Shopify, deals from HubSpot, invoices and payment status from Stripe, and alerts in Slack are typical connections, through direct JSON-2 calls or with n8n or Make in the middle. Before relying on any connector we check which endpoint it calls, and we list every existing script and its endpoint before a migration.

SBD has no published case study on Odoo and has not published a JSON-2 integration. The closest published work is an enquiry and quotation platform that works with SAP for an industrial distributor, and a sales channel inventory sync. We would test against a copy of your database and show you the results before anything touches production.

Fit

When to use an integration, and when not to

Outside integration makes sense when another system has to stay in place and both need the same orders, customers or stock. It is often the wrong answer in these cases:

  • An Odoo app or setting already covers the need. Turning it on costs less than maintaining a sync.
  • You need Odoo implemented, customised or your accounting set up. An Odoo partner is the right firm for that, and we can work alongside them on the connections.
  • You are on Standard and the integration is worth less than the plan change.
  • Your processes are still changing weekly, so a sync would keep breaking.

Engagement and cost

How an Odoo engagement with SBD works

Every engagement starts with an Automation Audit at $500, credited in full to your build. We confirm your plan and version, list what touches Odoo today and tell you what needs to move and by when. Workflows start at $1,500 and multi-module systems at $5,000, as a fixed price set after the audit. Bot users, keys and code stay in your accounts.

In every build

Standards we apply to every build.

Under the hood

  • Upserts keyed on the record

    Each write is matched on the source ID, so a retry or a re-fired event updates the existing record.

  • Retries with backoff

    Rate limits and timeouts are retried with increasing delays. If they still fail, they are parked for review.

  • Idempotent, loop-safe writes

    Two-way flows carry a marker so a change written by the sync does not re-trigger the sync.

  • Reconciliation

    A nightly job compares counts and totals on both sides and lists any record that differs.

  • Audit log

    Each run records the input, the mapping result, the action taken and what triggered it. You can search it by record.

For the team

  • Slack or email notifications

    Alerts go to a named person on your team, by Slack, email or WhatsApp.

  • A runbook

    One document per integration: what it does, what each alert means, and what to do in the first ten minutes.

  • Training

    A live session with the people who will use the review queue, recorded for whoever joins later.

  • Handover

    Admin access, billing and code sit in accounts in your name from the start, so the build keeps running if we stop working together.

  • Sixty days of hypercare

    The engineers who built it stay on call after go-live, fix what breaks and tune what the team asks for.

Keys and data

  • Keys are kept in a vault

    API keys and tokens are stored in the orchestration layer's encrypted credential store or the platform's secret manager. None are written into workflows, repos, spreadsheets or chat.

  • One credential per connection

    Each integration gets its own key, scoped to the objects and actions it needs. A lead sync cannot read invoices. Revoking one key stops one thing.

  • Service accounts for connections

    Connections use a dedicated service user in your account, so nothing breaks when a person leaves and nothing runs under someone's name.

  • Two-factor on every account

    Each platform account we set up has two-factor authentication on, and the recovery codes are handed to you.

  • Rotation on handover and on request

    Keys are rotated when the build is handed over, when anyone with access leaves, and at any time you ask.

The offer

Connect Odoo to the rest of your stack.

We agree a fixed scope in a discovery call, and most builds go live in three to five business days. The accounts are in your name, and the engineers who built it stay on call for sixty days after.

  • ScopeOne call to agree the workflows, the fields and the owner, written up the same day.
  • BuildValidation, upserts, retries, reconciliation and an audit log, on n8n, Make or code.
  • Go-liveWe test in a sandbox first, then switch over. It takes longer only where a vendor has to approve something.
  • HandoverRunbook, training session, alerts to a named owner, admin access and code in your accounts.
  • AfterSixty days of hypercare, then a care plan or run it yourself.

Questions

What people ask about Odoo.

Which Odoo plans include the external API?

Odoo's documentation, read in November 2026, says external API data access is only on Custom plans, and is not available on One App Free or Standard.

When do XML-RPC and JSON-RPC stop working?

Odoo's documentation, read in November 2026, schedules removal of the common and object services for Odoo 22 (autumn 2028) and Online 21.1 (winter 2027). The db service is listed as removed in Odoo 20 and Online 19.1.

Odoo

Start with the one Odoo workflow your team still runs by hand.

Bring it to a discovery call. You leave with a yes or no on fit, an outline of the build and what we would do first.

Book the call
A team of six gathered around one screen in an open-plan office
A discovery call with the people who own the process.

Cookie preferences

Choose what this site may use on your device. You can change this at any time from “Cookie settings” in the footer.

Strictly necessary

Keep the site working and remember the choices you make here. These cannot be switched off, and none of them track you.

Always on
What this includes (4)
NameProvider PurposeDuration
sbd-consentThis site Remembers your cookie choices12 months
Vercel Web AnalyticsVercel Inc. Counts page views in aggregate. Sets no cookie and stores nothing on your deviceNone
ticker-dismissed, sbd-note-offThis site Remembers that you closed a notice or language tipUntil the tab closes
sbd-voice-resume, sbd-voice-prefillThis site Carries a voice conversation across pages, only if you start oneUntil the tab closes

Analytics

Tell us which pages are read and where visitors leave, so we can improve them. IP addresses are anonymised and nothing is used for advertising.

What this includes (2)
NameProvider PurposeDuration
_gaGoogle Analytics (Google LLC) Distinguishes visitors with a random ID13 months
_ga_FPXDMQPRV1Google Analytics (Google LLC) Keeps the session state for this site13 months

Functional

Embedded services that set their own cookies. Without them the site still works; you get a link to open the service instead.

What this includes (1)
NameProvider PurposeDuration
Booking calendarCal.com Inc. Shows live availability and books the call on the booking pageSet by Cal.com

Advertising

Not used. This site has no advertising, retargeting or social media tracking, and we never sell data.

Not used

Questions about your data: hello@smallbaydigital.com