OdooWiki OCA HUB

WebService

webservice folder_open OCA/web-api open_in_new
Uncategorised License: AGPL-3

This module creates WebService frameworks to be used globally.

The module introduces support for HTTP Request protocol. The webservice HTTP call returns by default the content of the response. A context 'content_only' can be passed to get the full response object.

auto_awesome What this module does

AI-generated from the code · Odoo 19.0

Lets administrators register external web services (HTTP endpoints) in Odoo with their URL, authentication method and content type, and use them from other modules to send GET, POST or PUT requests.

This module adds a new screen called WebService Backend, found under the Settings menu, where administrators create and manage connections to external web services. Each record stores a name, a technical name, the endpoint URL, the expected content type (JSON, XML or Form) and, optionally, a company.

For each connection you choose how to authenticate: - Public (no credentials) - Username & password - API Key, with the header name to use - OAuth2, either Backend Application (client credentials) or Web Application (authorization code)

The form shows only the fields relevant to the selected authentication type and requires them, so you cannot save an incomplete configuration. For OAuth2 Web Application, a redirect URL is computed automatically and an "OAuth Authorize" button starts the authorization flow; after the provider redirects back, the token is stored on the connection and the user is sent back to the form. OAuth2 tokens are cached and renewed automatically before they expire.

Other modules can then call these connections to send GET, POST or PUT requests, with credentials and headers applied automatically. Sensitive values such as passwords, API keys and tokens are hidden in the interface, and URLs are cleaned before being written to logs. Access is restricted to system administrators, and records are filtered by company for multi-company setups.

Depends on

component

Required by other modules

edi_webserviceedi_webservice_ocawebservice_server_env
Models and fields (5)
  • base.requests · new model
  • webservice.backend · new modelurl, name, api_key (API Key), password, protocol, username, auth_type, tech_name, company_id (Company), oauth2_flow, content_type, oauth2_scope, oauth2_state, oauth2_token, redirect_url, api_key_header (API Key header), oauth2_audience (Audience), oauth2_clientid (Client ID), oauth2_token_url (Token URL), oauth2_token_method (Token Request Method), oauth2_client_secret (Client Secret), oauth2_authorization_url (Authorization URL), oauth2_client_auth_value (Client Auth Header Value), oauth2_client_auth_header (Client Auth Header), oauth2_client_auth_method (Client Authentication)
  • base.webservice.adapter · new model
  • oauth2.requests.web.application · new model
  • oauth2.requests.backend.application · new model

Text generated by AI (DeepSeek) from reading the Odoo 19.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub

Availability by version

Reviewed: 2026-11-03
Confirmed (verified in repository and branch) Estimated (unverified) No information

Confirmation status: 8 confirmed, 1 with no information of 9 versions.

terminal Installation and usage

OCA documentation · Odoo 19.0

Configuration

Source · Odoo 19.0

OAuth2 (Client Credentials)

For the Backend Application (Client Credentials Grant) flow, two extra options control how the token is requested, so that endpoints which deviate from the OAuth2 spec can still be used:

  • Token Request Method: POST (default) or GET. Most providers expose the token endpoint as a POST; some require a GET.
  • Client Authentication: how the client credentials are presented to the token endpoint:
  • Client ID & Secret (HTTP Basic) (default): the client id and secret are sent as an Authorization: Basic base64(client_id:client_secret) header (client_secret_basic).
  • Custom Authorization header: a static header value is sent verbatim. The Client Auth Header (default Authorization) and Client Auth Header Value are configured directly; the Client ID / Client Secret fields are not used in this case.

Example: custom Authorization header

Some providers require the credentials in a non-standard Authorization header (for instance Okta uses Authorization: SSWS <token>). Such an endpoint can be configured as:

Auth Type = OAuth2 OAuth2 Flow = Backend Application (Client Credentials Grant) Token URL = https://provider.example.com/oauth2/token Token Request Method = GET Client Authentication = Custom Authorization header Client Auth Header = Authorization Client Auth Value = SSWS

When a database is neutralized, stored webservice backend credentials (username, password, API key, OAuth2 client id/secret/token, custom OAuth2 auth header value) are cleared.

No verified information in OCA: Installation, Usage.

info

Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.