Odoo 19 Studio webhooks: real-time integration without opening a breach

Odoo 19 Studio can receive an event from an external system through a POST request and then execute an action in the ERP. An automation can also send a webhook notification when an event occurs in Odoo. This removes the wait for a scheduled job, but turns a simple URL into a business entry point.

For a Belgian or French SME, the use case can be practical: create a qualified contact, synchronise an order status or trigger a logistics process. The challenge is not making a demo work; it is ensuring that the flow remains secure, traceable and recoverable in production.

What Odoo 19 provides

In Studio, an incoming webhook combines a generated URL, a target model, logic that finds the correct record and one or more actions. Odoo says that connecting two Odoo databases can be configured without code, while a custom target or action may require development. For a non-Odoo sender, the mapping between incoming JSON and the target record must be adapted.

Call logging can be enabled. The secret embedded in the URL can be renewed with Rotate Secret; Odoo warns that the URL is confidential and that rotating it requires an update in the sending system. On the outgoing side, Send Webhook Notification sends selected fields by POST and displays a sample payload.

A secret URL is not a governance model

Reduce the effect of an unwanted call

The secret should be stored as sensitive credentials, never in a public ticket, screenshot or source repository. The essential control is the action authorised behind the URL. A rule that only updates the verified status of an identified order exposes less than a generic action able to create or change several objects.

Validate before writing

The flow must reject incomplete payloads, unknown references and impossible business transitions. External identifiers should be stable and distinct from internal technical IDs. If a sender retries an event after a network delay, an idempotency key or event register should prevent a second invoice, delivery or contact.

Do not confuse technical logs with an audit trail

Call logs help diagnose an error, but the business must also connect the external event, the decision made and the Odoo entry created. For finance or logistics flows, retain a correlation ID, status, timestamp and result, with retention suited to the data transported.

Test behaviour, not just a 200 code

Odoo documentation recommends configuring and testing the webhook on a duplicate database before production. A 200 OK or status: ok response indicates that the call works on the Odoo side; it does not prove that the right business rule ran exactly once.

Acceptance tests should cover the nominal message, missing fields, incorrect data types, unknown references, duplicates, out-of-order events and downstream downtime. Test secret rotation too: who changes the URL, how is the new value distributed, and how are calls still sent to the old URL detected?

When Studio is enough — and when to develop

Studio fits a short, targeted, reversible, low-volume action when the contract is stable. An integration layer or dedicated module is preferable when a flow must verify an additional signature, orchestrate several objects atomically, manage a queue and retries, transform data heavily or version its contract.

This boundary aligns the webhook with the Odoo JSON-2 API strategy: use a webhook to notify an event, an API to read or execute an explicit contract, and a server module when the business transaction must remain indivisible.

Underside analysis: operate each webhook as a small product

We recommend an operations sheet for every webhook: business and technical owners, environment, sender, Odoo model and action, message schema, sensitive data, volume, duplicate rules, maximum delay, alerts, rotation and shutdown procedure.

In a French-Belgian group, also define the company concerned and data permitted for each entity. An event valid for one company must not implicitly select another. Access rights and separation of duties remain part of the integration contract.

Checks before production

• Assign business and technical owners.
• Document JSON, required fields and permitted transitions.
• Limit the action to the necessary model, company and records.
• Protect the URL, organise rotation and test revocation.
• Make processing idempotent and trace a correlation ID.
• Test duplicates, ordering, errors, delays, recovery and downtime.
• Choose a module or integration layer when Studio is no longer enough.

Official sources

• Odoo 19 — creating, securing, logging and testing webhooks.
• Odoo 19 — automation rules and webhook notifications.