Does Odoo have an audit log for API calls?
No. Odoo does not record which API key read or changed what. Per record you see who changed it last and when, and the chatter shows changes to fields that have tracking on.
For an integration you wrote yourself, that is often enough. For an AI agent it is not. write_uid and write_date are overwritten on every change, so the previous editor is gone. The chatter names a user, not a key. And anything that was only read leaves no trace.
How do you see which integration changed something in Odoo?
Only if every integration has its own key and something records what each key does. Otherwise everything is logged under the user the key belongs to.
Put n8n, an import script and Claude under the same admin account and you cannot tell afterwards which of the three changed that quote. In Odoo, an API key simply is the user.
What are the options for an audit log in Odoo?
You can create a separate Odoo user per integration, install the OCA auditlog module, or use MCP Pro Governance. We make the last one, so read the table with that in mind.
| Separate user per integration | OCA auditlog | MCP Pro Governance | |
|---|---|---|---|
| What it records | Last editor and chatter, as always | Create, write and delete on the models you configure, with old and new value | Every call made with a key |
| Tells keys apart | Yes, through the user | No, per user | Yes |
| Reads | No | Optional, the log grows fast | Yes |
| Survives key revocation | Yes | Yes | Yes |
| Cost | One user licence per integration | Free, open source | Free, AGPL-3, Odoo App Store |
The OCA module lives in the Odoo Community Association's server-tools repository. Check that there is a version for your Odoo version before you count on it.
What should an audit log for AI agents record at minimum?
The key, the model and record, the action, the time, and whether it worked. And the log has to stay when you revoke the key, or cleaning up throws away your evidence too.
Reads belong in it. An agent reading through payroll changes nothing, but you want to be able to see it. Failed attempts too: an agent that keeps trying to write where it may not is telling you something.
Is an audit log enough to give AI safe access?
No. A log shows what happened afterwards and stops nothing. Limit what a key may do first.
Governance does that with a role per key: while a request with that key runs, the user only has that role's rights. Getting the rights inside Odoo right is covered in our guide to access rights. You do not skip that step, AI or not.
Does an audit log module work on Odoo Online?
No, Odoo Online does not let you install your own modules. There, a separate user per integration is the only route. It costs a licence per integration, but it works.