Migrating Odoo Integrations From XML-RPC and JSON-RPC to JSON-2

Introduction

Odoo integrations often become critical to daily business operations. CRM synchronization, eCommerce, accounting, inventory, reporting platforms, mobile applications, payment systems, and custom middleware may all depend on Odoo APIs.

For years, XML-RPC and JSON-RPC have been widely used to connect external systems with Odoo. With the introduction of JSON-2 in Odoo 19, organizations now have a modern API path for external integrations.

Odoo's current documentation states that the external XML-RPC and JSON-RPC APIs at /xmlrpc, /xmlrpc/2, and /jsonrpc are deprecated and scheduled for removal in Odoo 22 (fall 2028). For Odoo Online, the corresponding removal is scheduled for Online 21.1 (winter 2027). JSON-2 is the replacement API for these external RPC services. (Odoo)

For businesses with existing integrations, this is an opportunity to do more than replace an API endpoint. It is a chance to review integration architecture, authentication, data ownership, reporting flows, monitoring, and long-term maintainability.

Why Odoo Integration Migration Matters?

An organization may have more integrations than it realizes.

An Odoo database could be connected to:

• CRM and lead-generation platforms

• eCommerce websites

• Marketplaces

• Payment providers

• Shipping systems

• Mobile applications

• Business intelligence tools

• Data warehouses

• Accounting systems

• Custom applications

• Middleware and automation platforms

Some of these integrations may have been developed several years ago and may no longer have clear technical ownership.

A reporting script could still use XML-RPC. A custom connector may depend on JSON-RPC. A scheduled synchronization process may authenticate using an Odoo user and password.

This makes an Odoo XML-RPC migration a discovery and architecture exercise, not simply a development task.

The first objective should be to answer:

Which applications currently communicate with Odoo, what data do they exchange, and how critical are those connections?

Understanding JSON-2 in Odoo

JSON-2 is the newer external API introduced in Odoo 19. It exposes Odoo model methods through HTTP endpoints using the /json/2/<model>/<method> structure. (Odoo)

This differs from the older RPC approach.

With the legacy object service, integrations typically communicate through generic RPC endpoints and provide the model and method as part of the request.

With JSON-2, the model and method are part of the URL.

For example, conceptually:

Legacy RPC

/xmlrpc/2/object

JSON-2

/json/2/res.partner/read

JSON-2 also uses bearer API-key authentication and expects method arguments as named values in a JSON request body. Odoo notes that JSON-2 does not support positional arguments. (Odoo)

This means migration should include a review of how the existing integration authenticates, constructs requests, handles arguments, and processes responses.

XML-RPC, JSON-RPC and JSON-2: What Changes?

Odoo's documentation explains that JSON-2 replaces the external object service while changing several aspects of the request and authentication model. 

An important distinction is that the deprecation concerns Odoo's external RPC services. Odoo also notes that other custom controllers using @route(type='jsonrpc') are not covered by this specific deprecation notice

Therefore, organizations should identify exactly which API mechanism each integration uses before planning migration work.

Business Requirement: Start With an Integration Inventory

Before changing any integration, create an inventory.

For each connection, document:

Also identify:

• Authentication method

• API endpoints

• Models accessed

• Methods called

• Fields exchanged

• Data volume

• Error handling

• Retry mechanism

• Scheduled jobs

• Reporting dependencies

This inventory helps separate critical integrations from obsolete or low-value connections.

Some old integrations may no longer be required at all. Removing them can be more valuable than migrating them.

Architecture Choices for Odoo JSON-2 Migration

There is no single migration strategy that fits every organization.

Direct Migration

For smaller integrations, the external application can communicate directly with JSON-2.

This approach works well when:

• The integration is simple.

• There are few API calls.

• One team owns both systems.

• The existing business logic is straightforward.

Middleware Architecture

Organizations with many systems may benefit from an integration layer.

A simplified architecture can be:

External Applications → Integration Layer → Odoo JSON-2

The middleware can manage:

• Authentication

• Data transformation

• Logging

• Retry handling

• Monitoring

• Error processing

• Integration-specific business rules

This can reduce the number of direct connections to Odoo and improve governance.

Phased Migration

Large organizations can migrate integrations gradually.

A typical sequence is:

Inventory → Assess → Pilot → Migrate → Test → Cut Over → Monitor

This avoids changing every critical integration at the same time.

Authentication and Security Considerations

API migration is also an opportunity to improve security.

JSON-2 uses an API key through the Authorization: bearer HTTP header. Odoo recommends using dedicated bot users for long-running automated integrations and limiting their access to the permissions required by the integration. Instead of using one highly privileged account for every connection, organizations should consider dedicated integration identities.

For example:

Reporting Integration → Dedicated User → Read Access

Order Integration → Dedicated User → Required Sales Access

Inventory Integration → Dedicated User → Required Inventory Access

A migration should also review:

• API-key storage

• Key rotation

• User permissions

• Record rules

• Access rights

• Secret management

• Integration logging

• Credential revocation

This approach reduces the impact if an integration credential is compromised.

Odoo Data Governance During Migration

Changing the API does not automatically improve data quality.

If an existing integration creates duplicate customers, inconsistent products, or incorrect order mappings, moving it to JSON-2 will not solve the underlying problem.

Before migration, identify the system of record for important business data.

For example:

This prevents multiple systems from independently becoming authoritative for the same information.

Data governance should also cover:

• Unique identifiers

• Duplicate prevention

• Field mappings

• Company relationships

• Currency

• Time zones

• Status values

• Data ownership

• Historical records

A strong integration architecture should make it clear which system creates, owns, updates, and consumes each important data element.

Reporting Integrations Need Special Attention

Reporting integrations are easy to overlook during an API migration because they may operate silently in the background.

A business intelligence platform may regularly retrieve:

• Sales orders

• Invoices

• Customers

• Products

• Payments

• Inventory

• CRM opportunities

Before migrating a reporting integration, document its:

• Extraction schedule

• Models and fields

• Filters

• Incremental logic

• Historical data requirements

• Data transformations

• Failure handling

The test should not only confirm that API requests succeed.

The real question is:

Does the migrated integration produce the same business result?

For example, if a sales dashboard previously reported €2 million in revenue, the JSON-2 migration should not unexpectedly produce €1.8 million because of a changed filter, field mapping, company context, or synchronization rule.

Data reconciliation is therefore an important part of Odoo reporting migration.

Controls and Common Failure Modes

A reliable integration needs more than a successful API request.

During migration, plan for:

Authentication Failures

Invalid, expired, or revoked API keys should generate clear errors.

Permission Failures

The integration user may not have access to a model, field, or record.

Missing Records

An external system may attempt to update an Odoo record that no longer exists.

Validation Errors

Odoo business rules may reject a request even when the API structure is valid.

Network Failures

Temporary connectivity problems should not automatically result in lost transactions.

Duplicate Requests

Retry mechanisms should be designed carefully to prevent duplicate customers, orders, or other business records.

Monitoring

Critical integration failures should be visible to the responsible team rather than discovered later by business users.

Testing an Odoo JSON-2 Migration

Testing should cover both technical behavior and business results.

Functional Testing

Verify the major operations used by the integration:

• Reading records

• Creating records

• Updating records

• Searching records

• Processing business transactions

Data Testing

Compare the legacy and migrated results for:

• Record counts

• IDs

• Values

• Relationships

• Statuses

• Dates

• Company

• Currency

Security Testing

Verify that:

• Valid credentials work.

• Invalid credentials fail.

• Revoked credentials fail.

• Unauthorized operations are rejected.

• Integration users have only the required permissions.

Failure Testing

Test:

• Network interruptions

• Invalid requests

• Missing records

• Permission errors

• Odoo validation failures

• Duplicate requests

• Timeouts

For critical integrations, a controlled parallel run can also be useful. The old and new processes can be compared before production cutover.

A Practical Odoo XML-RPC Migration Roadmap

A phased approach can reduce risk.

Phase 1: Discover

Identify every XML-RPC and JSON-RPC integration.

Phase 2: Assess

Classify integrations according to:

• Business criticality

• Complexity

• Data volume

• Security risk

• Migration effort

Phase 3: Design

Define the JSON-2 architecture, authentication, data flow, monitoring, and failure handling.

Phase 4: Pilot

Start with a lower-risk integration to validate the migration approach.

Phase 5: Migrate

Move integrations in priority order rather than changing everything simultaneously.

Phase 6: Reconcile

Compare migrated data and business results against the existing integration.

Phase 7: Cut Over

Move production traffic to JSON-2 after validation.

Phase 8: Monitor and Retire

Monitor the new integration and remove obsolete legacy dependencies once the new architecture is stable.

Odoo JSON-2 Migration Governance Checklist

Before completing the migration, organizations should verify:

Integration Discovery

• All XML-RPC integrations identified

• All JSON-RPC integrations identified

• API consumers documented

• Integration owners assigned

• Critical integrations identified

Architecture

• JSON-2 target architecture defined

• Authentication strategy defined

• Data ownership documented

• Error handling implemented

• Retry strategy defined

• Monitoring established

Security

• Dedicated integration users reviewed

• API keys securely stored

• Minimum permissions applied

• Credential rotation process defined

Testing

• Functional testing completed

• Data reconciliation completed

• Security testing completed

• Failure scenarios tested

• Reporting validated

Production

• Cutover plan approved

• Rollback strategy prepared

• Monitoring active

• Legacy dependencies documented

• Legacy API retirement planned

Odoo's XML-RPC Deprecation Timeline

Organizations do not need to wait until the final removal date to begin planning.

According to the current Odoo 19 documentation, the external XML-RPC and JSON-RPC APIs are scheduled for removal in Odoo 22 in fall 2028 and Odoo Online 21.1 in winter 2027. 

The removal timeline was previously planned earlier and was subsequently postponed. Odoo's own development documentation records that the removal was moved to 21.1/22, giving organizations additional time to transition.

That additional time should be used for discovery and controlled migration rather than delaying the project.

Preparing for a Future-Ready Odoo Integration Architecture

The move to JSON-2 provides an opportunity to improve the entire integration landscape.

A future-ready architecture should provide:

• Clear ownership of integrations

• Secure authentication

• Controlled access

• Documented data flows

• Reliable error handling

• Monitoring and alerting

• Consistent data governance

• Scalable integration patterns

• Clear reporting dependencies

The objective is not simply:

XML-RPC → JSON-2

The larger objective is:

Legacy Integration → Governed, Secure and Maintainable Integration Architecture

Frequently Asked Questions

1. What is JSON-2 in Odoo?

JSON-2 is the newer external API introduced in Odoo 19. It provides access to Odoo model methods through /json/2/<model>/<method> endpoints. 

2. Is XML-RPC deprecated in Odoo?

Yes. Odoo has deprecated the external XML-RPC and JSON-RPC APIs and provides JSON-2 as their replacement. 

3. When will Odoo XML-RPC and JSON-RPC be removed?

The current Odoo documentation schedules their removal for Odoo 22 in fall 2028 and Odoo Online 21.1 in winter 2027.

4. Do existing XML-RPC integrations need to be migrated immediately?

They do not necessarily need to be replaced immediately, but organizations should begin auditing and planning their integrations now to avoid rushed migration work later.

5. Is JSON-2 the same as JSON-RPC?

No. JSON-2 is a different external API. It uses model/method URLs, bearer API-key authentication, and named JSON arguments. 

6. What should businesses check before an Odoo API migration?

Businesses should review API consumers, endpoints, models, methods, authentication, permissions, data mappings, reporting dependencies, error handling, and business-critical workflows.

7. Can Browseinfo help with Odoo JSON-2 migration?

Yes. Browseinfo can assess existing Odoo integrations, identify legacy API dependencies, review integration and data architecture, and create a phased JSON-2 migration strategy.

Conclusion

The transition from XML-RPC and JSON-RPC to JSON-2 is an important consideration for businesses running external Odoo integrations.

Because Odoo has deprecated its external RPC APIs and published a removal timeline, organizations should begin identifying their dependencies and planning migration well before the final deadline. 

A successful Odoo XML-RPC migration involves more than changing an endpoint. Businesses need to review integration architecture, authentication, permissions, data ownership, reporting dependencies, testing, monitoring, and failure handling.

For organizations with multiple Odoo integrations, this is also an opportunity to remove obsolete connections, improve data governance, and establish a more reliable foundation for future Odoo upgrades.

Browseinfo can help assess your existing Odoo integrations, identify XML-RPC and JSON-RPC dependencies, evaluate data and reporting flows, and create a practical JSON-2 migration roadmap. Request an Odoo integration architecture review to plan your transition with confidence.

Request an Odoo integration architecture review