Odoo XML-RPC and JSON-RPC deprecation: what Odoo 20 removed, and what is left until Odoo 22

What Odoo has announced

The Odoo 19 documentation for the External RPC API opens with a warning: "Deprecated since version 19.0. Both the XML-RPC and JSON-RPC APIs at endpoints /xmlrpc, /xmlrpc/2 and /jsonrpc are scheduled for removal in Odoo 22 (fall 2028) and Online 21.1 (winter 2027). The External JSON-2 API acts as a replacement."

The Odoo 20 version of the same page adds the step that has already happened. The RPC APIs expose three services, common, db and object, and "The db service was removed in Odoo 20 (fall 2026) and Online 19.1 (winter 2025). The common and object services are scheduled for removal in Odoo 22 (fall 2028) and Online 21.1 (winter 2027)." The 20.0 source still routes /xmlrpc/<service> and /xmlrpc/2/<service> (addons/rpc/controllers/xmlrpc.py).

One detail saves needless work: the notice covers only those three endpoints. Odoo's documentation says "The other controllers @route(type='jsonrpc') (known until Odoo 18 as type='json') are not subject to this deprecation notice." A custom controller in your own module that answers JSON requests is not affected.

Who needs to act, and when

• On Odoo Online: the old endpoints go when your database reaches Online 21.1, which can be as early as winter 2027. Online databases are upgraded on Odoo's timetable, so plan for the earliest date.
• On your own server or Odoo.sh, upgrading to 20: anything that manages databases over the db service stops working on 20. Record access keeps working until you reach Odoo 22.
• On 18 or earlier: nothing changes until you upgrade, and the JSON-2 API does not exist on your version yet. Plan the switch as part of the upgrade to 19, not before it.

Whatever the date, the cheapest time to move an integration is during an upgrade you are already testing, because the same rehearsal copy can test both.

Find what uses the old API

Integrations rarely live in one place. Look at each of these:

• Your own scripts and services: search the code for xmlrpc, /jsonrpc, execute_kw and ServerProxy.
• Connectors from vendors: e-commerce, shipping, payroll, BI and spreadsheet tools. Ask each vendor which Odoo API they call and when they will support JSON-2.
• Automation platforms: Zapier, Make, n8n and similar tools connect with whatever their Odoo connector was built on.
• Backup and deployment scripts: anything that lists, dumps or creates databases over RPC used the db service.
• The users the integrations log in as: API keys and passwords tied to integration users show you what to look for.

If you do not know what is connected to your Odoo, start there. The same inventory matters for every upgrade, and our article on finding forgotten customizations has read-only SQL that helps.

What the JSON-2 API looks like

The JSON-2 API is a plain HTTP API: "Post a JSON object at the /json/2/<model>/<method> URL." It authenticates with an API key sent as a bearer token in the Authorization header, and an optional X-Odoo-Database header names the database when the host name is not enough. The method's arguments go in the JSON body by name, with ids for the records and an optional context. This search is adapted from Odoo's own example, which calls search and then read; here one search_read call does both:

Read-only Odoo 19 and later

import requests

BASE_URL = "https://mycompany.example.com/json/2"
headers = {
    "Authorization": "bearer YOUR_API_KEY",
    "X-Odoo-Database": "mycompany",   # only when the host name is not enough
}
res = requests.post(f"{BASE_URL}/res.partner/search_read", headers=headers, json={
    "context": {"lang": "en_US"},
    "domain": [["name", "ilike", "%deco%"], ["is_company", "=", True]],
    "fields": ["name"],
})
res.raise_for_status()
print(res.json())

Three points in Odoo's documentation change how you run integrations, not just how you write them:

• API keys expire. The documentation says "it is not possible to create keys that last for more than three months," so long-lived keys "must be rotated at least once every three months." Put the rotation in someone's calendar, or an integration will stop on a quiet Sunday.
• Each call is its own transaction. Odoo's documentation recommends methods that do the whole job in one call, such as search_read, over several calls that each do part of it, so the data stays consistent.
• Plans matter on Odoo's hosting. The Odoo 20 documentation says access to data through the external API is only available on Custom pricing plans, and "is not available on One App Free or Standard plans."

A sensible order of work

1. List every integration and what it calls, and note which ones use the db service.
2. For each one you own, write the JSON-2 version against a test copy of Odoo 19. For each vendor connector, get the vendor's date in writing.
3. Create an integration user with only the access it needs, give it an API key, and record the expiry date.
4. Switch one integration at a time, and keep the old one ready until the new one has run a full business cycle, such as a month-end.

If your Odoo upgrade is coming up anyway, our Odoo 19 upgrade page explains how we rehearse an upgrade on copies of your database, which is also where the integrations get tested.

Questions people ask

Did Odoo 20 remove XML-RPC?

No, not for records. Odoo 20 removed the db service, which manages databases. The common and object services, which integrations use to log in and to read and write records, are scheduled for removal in Odoo 22 (fall 2028) and Online 21.1 (winter 2027).

What replaces XML-RPC in Odoo?

The JSON-2 API, new in Odoo 19. You post a JSON object to a URL made of /json/2/, the model name and the method name, with an API key as a bearer token in the Authorization header.

Do custom JSON controllers stop working?

No. Odoo's documentation says controllers declared with @route(type='jsonrpc'), known until Odoo 18 as type='json', are not subject to the deprecation notice. Only the /xmlrpc, /xmlrpc/2 and /jsonrpc endpoints are.

Can we use the JSON-2 API on Odoo 18?

No. Odoo's documentation marks it as new in version 19.0. On 18 or earlier, keep the existing integration and plan its move as part of your upgrade.

How long do JSON-2 API keys last?

At most three months. Odoo's documentation says long-lasting keys must be rotated at least once every three months, so the rotation needs an owner and a date.