What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Odoo database:- Users - every Odoo user, with name, login, email address, company, and status. Archived users are shown as disabled. Internal users are shown as standard users, portal users as external users, and the public website user as an anonymous user. Users with an enrolled authenticator app, or covered by your two-factor enforcement policy, are shown with multi-factor authentication required. Users linked to an OAuth sign-in provider are shown with single sign-on configured. Oleria also shows passkeys, the last sign-in or activity date, and who created each user.
- Non-human identities - every API key, as a personal access token owned by the user it belongs to, with its name, scope, creation date, and, on Odoo 18 and later, expiry date. An API key acts with all the permissions of its user. Oleria never sees a key’s value. Odoo’s system identities, such as OdooBot (the superuser) and the template users Odoo copies new users from, are shown as system identities.
- Access groups - every group, its members, and the groups it implies, so you can see access a user inherits through another group.
- Roles - Odoo’s user roles (Administrator, User, Portal, and Public, plus Light on Odoo 20) and who holds each.
- Resources and access - the business models that a group can read, write, create, or delete, and your companies and branches with the users allowed in each. On Odoo 16 to 19, an access right that isn’t tied to a group applies to every user, so Oleria shows it on every role.
- Database managers - a group named Odoo database managers (synthesized) stands for the people who control the database outside Odoo, such as the database managers on odoo.com, Odoo.sh collaborators, or whoever holds the master password of an on-premise server. Odoo’s API doesn’t list these people, so the group has no members.
- Activity - sign-ins, changes to tracked fields on business records, other record notifications such as stage changes (shown as custom activity), API key creation, and user creation. On Odoo 18 and later, each sign-in session is shown with its IP address and location, and on Odoo 18 and 19 also with its browser.
Prerequisites
- An Odoo database on Odoo 16.0 or later. On Odoo Online, the database must be on the Odoo Custom plan, because Odoo offers the External API only on Custom, not on One App Free or Standard. Odoo.sh and on-premise databases can be used as they are.
- A dedicated internal Odoo user for Oleria, with the Administrator role and access to every company. See Create the Odoo API user.
- An Odoo URL that Oleria can reach over HTTPS. Odoo Online and Odoo.sh databases at
https://<database>.odoo.comare reachable as they are. If your Odoo uses a custom domain or is self-hosted, contact support@oleria.com to allowlist its hostname before you connect. Oleria doesn’t connect to private or loopback addresses. - Admin access to the Oleria workspace.
Permissions Oleria needs
Oleria needs the user’s Settings access right under Administration (base.group_system). On Odoo 19 and later, this is the Administrator role. The user must also have every company, including archived ones, in its Allowed Companies.
Below these permissions, Odoo hides some users, other users’ API keys, sign-in logs, and system settings from the API user. Oleria would then see only part of your users, and the missing ones would look deleted. So Oleria refuses to connect, sync, or run actions with a user that isn’t an administrator or isn’t allowed in every company.
Create the Odoo API user
1
Create a dedicated user
In Odoo, go to Settings -> Users & Companies -> Users and create an internal user for Oleria, for example
oleria-api.2
Grant the Administrator role and every company
Under Administration, give the user the Settings access right. On Odoo 19 and later, set its role to Administrator. Add every company to the user’s Allowed Companies.
3
Create an API key
Sign in as that user, open Preferences -> Account Security, select New API Key, and copy the key. On Odoo 18 and later, a key created by an administrator can be persistent. Otherwise, Odoo expires it within 90 days, and you need to update the integration with a new key. On Odoo 16 and 17, API keys don’t expire.
The exact location of these settings can change between Odoo versions. If the steps above don’t match what you see, refer to Odoo’s own documentation.
Connect Odoo to Oleria
1
Find Odoo in Oleria
Go to your Oleria workspace, select Integrations, select the Available tab, and search for Odoo.
2
Complete the connection form
Select the Odoo card and fill in the form:
3
Authenticate
Select Authenticate. Oleria checks that the database runs Odoo 16.0 or later, that the API key belongs to the login you entered, and that the user is an administrator allowed in every company, before it saves the connection.
Verify the integration
Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, API keys, groups, roles, and activity in your Oleria workspace.When you edit the integration, you can change its fields and select Update. Leave API key (optional) blank to keep the stored key, and enter a new key only when you rotate it. You can move the integration to a new Odoo URL, for example after a domain change, but not to a different database. To connect another database, add a new integration.
Odoo rejected the login and API keyorOdoo rejected the API key: check the database name and the login, and that the key hasn’t expired or been revoked.could not reach the Odoo database at <URL>: check the Odoo URL. If your Odoo uses a custom domain or is self-hosted, check that its hostname has been allowlisted, as described in Prerequisites.Odoo <version> is not supported: the connector needs Odoo 16 or later: upgrade the database to Odoo 16.0 or later.Odoo refused the API call (HTTP <status>); the external API requires the Odoo Custom plan on Odoo Online: on Odoo Online, check that the database is on the Odoo Custom plan.the Odoo API key's user is not an Administratororthe Odoo API key's user is not allowed in every company: update the user as described in Create the Odoo API user.the Odoo API key could not be verified: on Odoo 19 and later, check that the login is the one of the user who owns the API key.the URL and database now point at a different Odoo database: when you edit the integration, the URL and database name must still lead to the database you first connected. To connect another database, add a new integration.
Remediation actions
Beyond discovery, Oleria can act on Odoo access to remediate risk. Every action needs the permissions described in Permissions Oleria needs.
Keep these limits in mind when you use these actions:
- Oleria reads the user or group before it changes anything. If it’s already in the requested state, Oleria makes no change, and reverting the action makes no change either. Create user is the exception: it fails if a user with that login already exists.
- After it changes an existing user’s status, groups, role, or companies, Oleria reads the user again to confirm Odoo applied the change. If Odoo accepted the change but the new read shows it didn’t apply, Oleria undoes the change and the action fails. Create user, Create group, and Delete user don’t undo anything: if the new read doesn’t confirm the change, the action fails, and a failed Create user or Create group may still have created the user or group in Odoo.
- Reverting an action undoes only the change that action made. If the user no longer exists, or is already back in its earlier state, the revert makes no change and says why. Reverting Add user to group or Remove user from group fails if the group has been deleted. On Odoo 16 to 18, reverting Add user to group also fails if the user now holds the group through another group.
- Oleria won’t archive, delete, or change the groups, role, or companies of the connection’s own user, because that could disconnect the integration.
- Oleria won’t change Odoo’s system identities: OdooBot, the public website user, and the template users.
- Oleria can’t change the Odoo database managers (synthesized) group. Manage those people on odoo.com, in Odoo.sh, or on your Odoo server.
- Creating an active user or enabling a user can add a paid user to your Odoo subscription. A user created archived doesn’t use a seat until it’s enabled.
- Oleria can’t revoke an API key or end a user’s sessions. See Known limitations.
Known limitations
- Record rules aren’t reflected. Oleria shows access at the business-model level, from the groups’ access rights. Odoo record rules can narrow that access further, for example to the user’s own company or documents, and Oleria doesn’t subtract them.
- No failed sign-ins or access-right changes in activity. Odoo doesn’t record failed sign-ins or changes to groups, access rights, or two-factor settings in a form Oleria can read.
- Sign-in history on Odoo 16 and 17. Before Odoo 18, Odoo keeps only each user’s latest sign-in, so Oleria can’t import a full sign-in history.
- No changed field names on Odoo 20. Odoo 20 no longer exposes which fields a record change touched, so Oleria shows the change without the field names.
- No API key last-used date or password change date. Odoo doesn’t record when an API key was last used or when a user last changed their password.
- License level isn’t available. Odoo bills active internal users but doesn’t expose a seat field in its API.
- API keys and sessions can’t be revoked from Oleria. Odoo requires an interactive password check to revoke an API key or end a user’s sessions. To stop a user’s API keys, archive the user with Disable user accounts.