odoo-rpc-sweep

Find the code that still calls Odoo through XML-RPC or JSON-RPC, before Odoo removes those APIs.

pip install odoo-rpc-sweep                          # or: pipx run odoo-rpc-sweep ...
odoo-rpc-sweep ./my-integrations                   # Markdown report
odoo-rpc-sweep ./my-integrations --format csv > sweep.csv
odoo-rpc-sweep workflow-export.json                 # a single n8n export

No dependencies. Python 3.9+. It reads files and prints a report. Nothing is sent anywhere.

Why

From Odoo's own documentation:

• /xmlrpc, /xmlrpc/2 and /jsonrpc are deprecated in Odoo 19.
• The db service (create, duplicate, drop or list databases) is removed in Odoo 20 (fall 2026) and in Odoo Online 19.1.
• The common and object services are scheduled for removal in Odoo 22 (fall 2028) and Odoo Online 21.1 (winter 2027).
• The replacement is JSON-2: POST /json/2/<model>/<method>, an API key as a bearer token, named arguments only, one transaction per request.

Sources: Odoo 19.0 External API · Odoo 20.0 External API

So not everything breaks on Odoo 20. Only database-management calls do. The rest keeps working, with deprecation warnings, until Odoo 22. This tool tells you which is which.

What it reports

It reads code (.py .js .mjs .cjs .ts .php .rb .java .cs .go .sh .json .yml .yaml) and the config and deploy files where an endpoint often lives instead (.env, .env.*, .ini .cfg .conf .toml .properties .tf .tfvars, Dockerfile*, Containerfile*). A user:password@ inside a URL is masked as ***@ in the report. It skips .git, node_modules, virtualenvs, build output and tool caches, and any file over 2 MB (listed as "not read").

n8n: workflow exports are parsed, not just searched. The Odoo node's v2 uses JSON-2 when it's set up with the API-key credential, and /jsonrpc with the older username/password credential. v1 always uses /jsonrpc. So a v2 node on an API-key credential is reported as clean (n8n source).

Exit codes

3 is never reported as clean, so it's safe to use as a CI gate:

- run: pipx run odoo-rpc-sweep .   # fails the build while legacy calls remain

Limits (read these)

• It's a pattern match. It finds candidates, and a person confirms each one. A URL built from pieces (base + "/xml" + "rpc") can slip past it.
• An endpoint that only exists in a deployed environment (a secret store, a CI variable, a server's environment) isn't in any file it can read. Point it at your deploy config as well as your code, or use the scanner module below to see the calls that actually arrive.
• It only sees the code you point it at. For the calls actually hitting your Odoo, including ones from code you don't have, install the free RPC Migration Scanner module on Odoo 19. It records every legacy caller by user, API key and method. Store modules can't be installed on Odoo Online, and that's where this tool comes in.
• Third-party connectors (Zapier, Make, a vendor's packaged app) have to be migrated by their vendors.

Help with the migration

Built and maintained by AIQSO, which offers fixed-price Odoo API migrations. Questions and bugs: GitHub issues, or odoo-apps@aiqso.io.

License

MIT

Releasing (maintainers)

1. Bump __version__ in src/odoo_rpc_sweep/__init__.py and date the CHANGELOG.md entry.
2. git tag vX.Y.Z && git push origin vX.Y.Z
3. Approve the pypi environment in the Actions run. The upload uses PyPI trusted publishing, with no stored token.