Odoo external API documentation: XML-RPC and JSON-RPC in 2026.

This page is a map to Odoo S.A.’s own docs, not a rewrite of their Python examples. Language samples (Python, Ruby, PHP, Java, Go) stay on odoo.com. Use this when the search is “where is the XML-RPC / JSON-RPC documentation in 2026?” Use JSON-2 vs XML-RPC vs JSON-RPC when the search is “which one should a new integration use?”

Where the official External API docs live in 2026

• Odoo 19 — current external API: JSON-2 (POST /json/2/<model>/<method>, Authorization: bearer). Deprecated XML-RPC / JSON-RPC: External RPC API.
• Odoo 18 — XML-RPC (and JSON-RPC) still documented as the External API. There is no JSON-2 on 18.
• Odoo 17 — same shape as 18: External API on XML-RPC. No JSON-2. Odin’s in-Odoo MCP module is 18 and 19, not 17.

Odoo 19’s RPC page states that /xmlrpc, /xmlrpc/2 and /jsonrpc are scheduled for removal in Odoo 22 (fall 2028) and Online 21.1 (winter 2027). Internal @route(type='jsonrpc') controllers (called type='json' until 18) are a different notice — they are not that deprecation.

xmlrpc/2/common and xmlrpc/2/object

Official XML-RPC is two endpoints. /xmlrpc/2/common is unauthenticated meta: version(), then authenticate(db, username, password, {}) which returns a uid. /xmlrpc/2/object is where work happens: execute_kw(db, uid, password, model, method, positional, keyword).

That is the API every “search_read partners in Python” gist is calling. API keys (since 14.0) replace the password on those calls; they are not a separate HTTP bearer scheme. JSON-2 is bearer. Mixing the two is the usual 19 migration bug.

Odoo Online users often have no local password until an admin sets one via Action → Change Password. The 17/18/19 RPC docs all say that. External API access on Online is Custom plans only — not One App Free, not Standard. Cite the same note on every version’s External API page; do not promise RPC on Standard Online.

JSON-RPC is /jsonrpc, not JSON-2

JSON-RPC wraps the same external RPC idea in JSON at /jsonrpc. JSON-2 is /json/2/<model>/<method> with named JSON arguments and a bearer key. Reviewers confuse the names. If a README says “JSON API” and the path is /jsonrpc, it is the deprecated service on 19, not JSON-2.

Odoo documents both XML-RPC and JSON-RPC together on the 19 RPC page. Language examples for search, read, create, write, unlink, search_read, and fields_get are there — copy from odoo.com, not from a 2014 blog that still hits /xmlrpc/2 as if it were the 19 recommendation.

What still works vs what you should not start

On Odoo 17 and 18, XML-RPC/JSON-RPC is the documented external API. Keep using it for those versions. On Odoo 19, it still runs, and Odoo has published a removal year — do not start a new AI or middleware stack there. Prefer JSON-2, or an in-Odoo module that uses the ORM and never exposes the old RPC.

Community “Odoo MCP” repos that authenticate with uid/password against execute_kw are an RPC choice. Fine as a 18 holding pattern; a 19 mismatch if the README claims current. MCP vs JSON-2 · JSON-2 authentication (keys expire in at most three months on 19).

Why this documentation page exists next to the compare table

Search Console still sends people looking for “odoo external api documentation json-rpc xml-rpc.” They want the official URLs and endpoint names. The compare article answers “prefer JSON-2.” Both should exist; neither should copy the other’s H2s. After you have the docs, the decision is: stay on RPC until 18 is retired, or move 19 callers to JSON-2 before Odoo 22.

Official documentation

• Odoo 19 External API (JSON-2)
• Odoo 19 External RPC API (XML-RPC / JSON-RPC, deprecated)
• Odoo 18 External API (XML-RPC)
• Odoo 17 External API (XML-RPC)