WebService Core
This module provides the webservice.backend model with its authentication (public, username/password, API key) and HTTP call features (get/post/put/delete).
It has no dependency on component or server_environment, so it can be used as a lightweight building block by any module needing to configure and call an outbound webservice, without pulling in extra frameworks.
On top of a backend, you can configure specific, named webservice.endpoint records via the UI, instead of only building calls in Python via webservice.backend.call(method, url_args, ...). Each endpoint bundles a required description, a fixed HTTP method and relative path (appended to the backend URL), static headers, and an optional authentication override, fully independent from the backend’s. Endpoints are called with endpoint.call(...); calling the backend directly with backend.call(method, ...) remains fully supported.
Table of contents
Configuration
Go to Settings > Technical > WebService Backend (requires the Administration / Settings group) and create a new backend:
Name / Technical Name: a label and a unique technical key you’ll use to look the backend up from code (e.g. env.ref is not used here; search by tech_name instead).
Protocol: only HTTP Request is available in this module.
URL: the base URL every call is relative to, e.g. https://api.example.com. It may contain {placeholder} tokens (see Usage), e.g. https://api.example.com/{endpoint}.
Content-Type: optional default Content-Type header for every call.
Timeout: optional timeout in seconds for the whole request (connect + read). Left empty, a call waits indefinitely.
Under the Headers and Querystring Params tabs you can configure static defaults, merged into every call (see Usage).
Then configure authentication via Auth Type:
Public: no credentials needed.
Username & password: sent as HTTP Basic Auth. Requires Username and Password.
API Key: sent as a custom header. Requires API Key and API Key header (the header name to send it under, e.g. X-Api-Key).
Required fields depend on the selected auth type; the form only shows and requires the ones that apply, and saving enforces it.
Each webservice.endpoint (see Description) has its own Content-Type, Timeout, Headers and Querystring Params, overriding the backend’s own for that specific endpoint - set only what needs to differ.
Usage
Look up the backend (e.g. by its technical name) and call it:
backend = env["webservice.backend"].search([("tech_name", "=", "my_api")])
result = backend.call("get") # -> the full requests.Response object
call(method, *args, **kwargs) accepts any of the standard HTTP verbs (get, post, put, delete) and forwards everything else to requests, so any of its keyword arguments work too (data, json, params, files, …):
backend.call("post", data=b"<xml>...</xml>")
backend.call("post", json={"foo": "bar"})
URL: by default the backend’s own url is used. Pass url to hit a different path - relative paths are appended to the backend’s URL, a full http(s):// URL is used as-is:
backend.call("get", url="orders") # -> <backend url>/orders
backend.call("get", url="https://other.example.com/orders")
If the backend’s URL (or the url passed above) contains {placeholder} tokens, fill them with url_params:
# backend.url == "https://api.example.com/{endpoint}"
backend.call("get", url_params={"endpoint": "orders"})
Headers: pass headers to add/override headers for that call; they are merged on top of the backend’s own static headers (configured in the “Headers” tab), Content-Type and auth-derived headers (e.g. the API key header) - the headers kwarg wins on matching keys:
backend.call("get", headers={"X-Request-Id": "42"})
Querystring params: sent via requests’ params=, not to be confused with url_params above, which fills {placeholder} tokens in the URL path itself. Configure static defaults in the “Querystring Params” tab - a value there may itself contain a {placeholder}, resolved against the same url_params used for the URL. An explicit params kwarg passed to call() wins over the static configuration on matching keys:
backend.call("get", params={"verbose": "1"})
Auth override: pass auth to bypass the backend’s configured auth type for a single call (same format requests itself accepts, e.g. a (user, password) tuple):
backend.call("get", auth=("other_user", "other_password"))
Timeout: pass timeout to override the backend’s own configured timeout (in seconds) for a single call:
backend.call("get", timeout=5)
Response: call() always returns the full requests.Response object (status code, headers, content, …):
response = backend.call("get")
response.status_code
response.content
Bug Tracker
Bugs are tracked on GitHub Issues. In case of trouble, please check there if your issue has already been reported. If you spotted it first, help us to smash it by providing a detailed and welcomed feedback.
Do not contact contributors directly about support or help with technical issues.
Credits
Contributors
Simone Orsi <simone.orsi@camptocamp.com>
Enric Tobella <etobella@creublanca.es>
Alexandre Fayolle <alexandre.fayolle@camptocamp.com>
Maintainers
This module is maintained by the OCA.
OCA, or the Odoo Community Association, is a nonprofit organization whose mission is to support the collaborative development of Odoo features and promote its widespread use.
Current maintainer:
This module is part of the OCA/web-api project on GitHub.
You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.
Metadata
Release files for odoo-addon-webservice-core 18.0.1.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| odoo_addon_webservice_core-18.0.1.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Release files / odoo_addon_webservice_core-18.0.1.2.0-py3-none-any.whl
| Download URL | odoo_addon_webservice_core-18.0.1.2.0-py3-none-any.whl |
|---|---|
| Size | 53.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d65a2349d8bb60495a44d2d32c0b739eb2199ec3ebd1fb4a0465b00a67c572ff
|
|
BLAKE2b-256 checksum How to use checksums |
580827863b563717dae04352aff32c3bba3ddc76a4a8c0ddb6aea001940e9c98
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.4
|
Security for odoo-addon-webservice-core 18.0.1.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.