Building REST API Endpoints for Your Custom Odoo Modules

custom_api/
├── __init__.py
├── controllers/
│   ├── __init__.py
│   └── main.py  <-- Your API logic lives here
├── models/
└── security/

from odoo import http
from odoo.http import request, Response
import json
import logging

_logger = logging.getLogger(__name__)

class CustomApi(http.Controller):
    
    @http.route('/api/v1/orders', type='http', auth='public', methods=['GET'], csrf=False)
    def get_orders(self, **kw):
        """
        Endpoint to fetch orders.
        URL: GET /api/v1/orders?customer_id=123
        """
        try:
            # 1. Authentication (Simulated Token Check)
            api_key = request.httprequest.headers.get('Authorization')
            if not self._check_auth(api_key):
                return self._response({'error': 'Unauthorized'}, 401)
            
            # 2. Logic
            customer_id = kw.get('customer_id')
            if not customer_id:
                return self._response({'error': 'Missing customer_id'}, 400)
            
            # Use sudo() carefully if auth='public' to access records
            orders = request.env['sale.order'].sudo().search([
                ('partner_id', '=', int(customer_id))
            ])
            
            # 3. Serialization (Odoo records -> JSON)
            data = []
            for order in orders:
                data.append({
                    'id': order.id,
                    'name': order.name,
                    'amount': order.amount_total,
                    'state': order.state,
                    'date': str(order.date_order),
                })
            
            return self._response({'status': 'success', 'data': data}, 200)
        
        except Exception as e:
            _logger.error("API Error: %s", str(e))
            return self._response({'error': 'Internal Server Error'}, 500)
    
    def _check_auth(self, token):
        # Implement your token validation logic here
        # Example: Compare against a token stored in res.company
        valid_token = request.env.company.sudo().x_api_token
        return token == f"Bearer {valid_token}"
    
    def _response(self, data, status=200):
        return Response(
            json.dumps(data),
            status=status,
            headers={'Content-Type': 'application/json'}
        )

@http.route('/api/v1/leads', type='http', auth='public', methods=['POST'], csrf=False)
def create_lead(self, **kw):
    try:
        # Parse JSON body
        data = json.loads(request.httprequest.data)
        name = data.get('name')
        email = data.get('email')
        
        if not name or not email:
            return self._response({'error': 'Missing name or email'}, 400)
        
        # Create Record
        lead = request.env['crm.lead'].sudo().create({
            'name': name,
            'email_from': email,
            'type': 'lead'
        })
        
        return self._response({
            'status': 'created',
            'id': lead.id
        }, 201)
    
    except Exception as e:
        return self._response({'error': str(e)}, 500)

@http.route('/api/v1/orders/<int:order_id>', type='http', auth='public', methods=['PUT'], csrf=False)
def update_order(self, order_id, **kw):
    # Odoo automatically parses <int:order_id> from the URL
    data = json.loads(request.httprequest.data)
    order = request.env['sale.order'].sudo().browse(order_id)
    
    if not order.exists():
        return self._response({'error': 'Order not found'}, 404)
    
    # Update logic
    if 'note' in data:
        order.write({'note': data['note']})
    
    return self._response({'status': 'updated'}, 200)