Odoo has corrected its version 19 documentation: the legacy XML-RPC and JSON-RPC services are no longer scheduled for removal in Odoo 20, but in Odoo 22, expected in autumn 2028. They remain deprecated, and the external JSON-2 API remains their replacement.
This postponement creates room to manoeuvre; it does not remove the work. For Belgian and French companies, Odoo connectors often feed eCommerce, logistics, finance, analytics or line-of-business applications. An API break can therefore stop much more than a technical exchange.
What changes — and what does not
The /xmlrpc, /xmlrpc/2 and /jsonrpc endpoints will remain available longer. Custom controllers declared with @route(type='jsonrpc') are not covered by this deprecation notice. Teams must therefore distinguish generic external RPC services from routes developed in custom modules.
JSON-2 is available from Odoo 19. Calls use a URL such as /json/2/<model>/<method>, a JSON body with named arguments, and an API key sent as a Bearer token. When several databases share one domain, the X-Odoo-Database header selects the database.
Why this is not merely a transport rewrite
Authentication and access rights
Legacy calls commonly send the database, user ID and password with every request. JSON-2 relies on API keys. Migration should introduce one technical account per integration, least-privilege access, appropriate expiry, key rotation and a tested revocation procedure. An API key does not bypass the Odoo permissions of its owner.
Arguments and contracts
JSON-2 requires named arguments. Clients built around positional parameters must therefore be mapped method by method. Each database's dynamic documentation, available under /doc, helps teams verify the methods and their actual signatures.
Transactions
Each JSON-2 call runs in its own SQL transaction. Chaining “create, confirm, then write another object” through several requests does not make the overall operation atomic. When a business operation must succeed or fail as a unit, Odoo recommends a dedicated method in a module, invoked through a single request.
Impact on Odoo upgrade programmes
A company running Odoo 16, 17 or 18 cannot simply switch its client to JSON-2: the API appears in Odoo 19. The integration plan must therefore follow the version roadmap. Teams can prepare an adapter, contract tests and a usage inventory now, then activate JSON-2 against the Odoo 19 test environment.
New connectors on Odoo 19 should start directly on JSON-2 to avoid adding known technical debt. Existing integrations should be prioritised by business criticality, frequency, ownership and test coverage — not just by call count.
Underside analysis: manage APIs as a portfolio of contracts
We recommend avoiding a blind, global conversion. Build a register for every flow: calling system, Odoo version, technical account, models and methods, volumes, criticality, sensitive data, recovery rules and business owner.
This inventory often uncovers ownerless scripts, shared keys or sequences that wrongly assume several calls form one transaction. The additional time should be used to correct these architecture risks. Controlled parallel runs, comparing results without creating duplicate writes, are safer than a big-bang switch.
Recommended roadmap
- Find every use of
/xmlrpc,/xmlrpc/2and/jsonrpcin code, iPaaS platforms and operations scripts. - Separate generic external APIs from custom JSON-RPC controllers.
- Rank flows by business criticality and Odoo-version dependency.
- Create separate technical accounts and keys with least privilege and tested rotation.
- Document current contracts: inputs, outputs, errors, idempotency and volume limits.
- Move sequences requiring atomicity into one dedicated server-side method.
- Test JSON-2 on representative data, including denied access, timeouts, duplicates and recovery.
- Schedule retirement of the old client before Odoo 22, with a measured coexistence period.
This work belongs in the Odoo migration plan and the security and access-rights model, because technical and operational risks are closely connected.
Official sources
- Odoo 19 — external JSON-2 API and migration from XML-RPC/JSON-RPC.
- Odoo 19 — deprecated external RPC API.
- Odoo documentation — official postponement of removal to Odoo 22.
Underside helps teams inventory, secure and migrate Odoo integrations. The goal is to replace a protocol without weakening the business contracts that depend on it.