Odoo, Microsoft 365, Google Workspace: which software can an AI agent connect to?

In short

• An AI agent can connect to Odoo, Microsoft 365, Google Workspace, Sellsy, Axonaut, Holded, Teamleader and Exact Online through their official interfaces (APIs). Each one documents its own. Conditions vary: Odoo requires a “Custom” plan, and Holded a paid plan. Limits are not always published.
• With Odoo, one deadline matters: the two older interfaces, XML-RPC and JSON-RPC, are due to disappear with Odoo 22 in autumn 2028, and from winter 2027 on Odoo Online.
• Our rule: to begin with, the agent reads and prepares, and every write waits for your team's approval. The agent never pays. Sending a binding document to a third party, or deleting data, always requires approval.

Is your accounting run on Odoo and your email on Microsoft 365? An AI agent can connect to them through each software's API. An API is an official entry point: a program reads data from it or submits an action to it, with permission.

We read the official documentation on 12 and 13 October 2026. Where a limit is not published there, we say so.

What a connector does: read, suggest, write with your approval

A connector is the small program that links the agent to a piece of software. It does three things:

• Read emails, invoices and client records. Read-only when the software allows it.
• Suggest a draft reply, a payment reminder or a quote, which you approve.
• Write with your approval: to begin with, an action goes out only after someone on your team gives the go-ahead. Later, the agent can act alone on simple cases, described in writing beforehand. This happens only after a measurement period and with your written agreement. The agent never pays. Sending a binding document to a third party, or deleting data, always requires approval.

For example, an SME with 40 employees invoices in Odoo and talks to its clients in Outlook. The agent reads the replies, finds the invoice and prepares a payment reminder. The accountant approves, corrects or rejects it. If a client disputes the invoice, the agent stops and hands over to her.

Email: Microsoft 365 (Graph) and Google Workspace (Gmail API)

Microsoft 365 opens up through Microsoft Graph. The application registers in Microsoft Entra, Microsoft's directory of accounts. It then acts on behalf of a signed-in user or with its own identity. Two points matter:

• The permission to write emails, Mail.ReadWrite, does not include sending, which requires Mail.Send. The agent can therefore prepare drafts without being able to send them.
• When granted without a user, read access covers every mailbox in the organisation. Your administrator can restrict it to certain mailboxes, for example “contact@”. Condition: remove the global permission granted in Entra. Otherwise the two permissions add up and the restriction has no effect.

Limits: 10,000 requests per 10 minutes, 4 simultaneous requests and 150 MB of data sent (creations and changes) per 5 minutes, for each application and mailbox pair. Beyond that, Graph replies “too many requests” and the agent waits.

Google Workspace opens up through the Gmail API, with OAuth 2.0: a protocol that grants limited access without handing over a password. The permissions are called “scopes”. Google classes gmail.readonly, gmail.compose and gmail.modify as “restricted”: a public application that uses them goes through a verification, and a security assessment if it stores or transmits this data on servers.

A useful exception: an application declared “internal” does not have to go through this verification. It must be reserved for people in the client's Google Workspace organisation, in a project that belongs to that organisation. Google states that in this case restricted scopes need no additional review. The project is therefore created in the client's organisation. Google's rules on user data still apply.

A difference from Microsoft: with Google, the drafts scope, gmail.compose, also allows sending. So it is the connector, not the permission, that has to block sending without approval.

Quotas: 1,200,000 units per minute per project, 6,000 per minute per user. Sending a message costs 100 units, reading one costs 20. Worth watching: Google plans to charge for overuse “later in 2026”, with at least 90 days' notice, and no date has been published so far.

Odoo 19: the new JSON-2 API and the end of XML-RPC and JSON-RPC with Odoo 22

Odoo 19 introduces the JSON-2 external API, with an API key attached to every call. What you need to know:

• The plan: the external API is open only on Odoo's “Custom” plans, not on “One App Free” or “Standard”.
• The key lasts three months at most. It must therefore be renewed at least every quarter. We will track its end date to avoid an outage.
• The account: Odoo recommends a dedicated “robot” user with minimal rights. The agent can only do what that account can do.
• Transactions: each call is committed or rolled back on its own. You cannot group several calls into a single operation that succeeds or fails as a whole.

The deadline: XML-RPC and JSON-RPC, Odoo's two older interfaces, are deprecated, meaning still in service but due to disappear. Odoo plans to remove them in Odoo 22, in autumn 2028, and from version 21.1 of Odoo Online, in winter 2027. JSON-2 exists only from version 19. A connector for Odoo 17 or 18 therefore still uses XML-RPC or JSON-RPC. It will have to change interface before you move to Odoo 22.

Business software in France, Spain and Belgium: Sellsy, Axonaut, Holded, Teamleader, Exact Online

• Sellsy (French vendor): API V2. Access is created in Settings > Developer Portal, and scopes limit its rights. A request only succeeds if the person who created the access holds the required licence. Beyond the limits, the API refuses calls. Sellsy advises 200 ms between two calls, without publishing a numerical quota.
• Axonaut (French vendor): API v2 (quotes, invoices, payments, expenses, projects, tickets). The API key goes in the userApiKey header, a piece of technical information attached to every call. Limits: none is published in the API description.
• Holded (Spanish vendor): API v2, open on paid plans, not on the free plan. The key is created in the settings, under Developers. For each key, you choose the access to each module: read, write or full. Limit: a monthly cap, which depends on the plan.
• Teamleader Focus (Belgian vendor): OAuth 2, with a token that usually expires after one hour, then is renewed. Limits are counted per integration and per Teamleader account, over a rolling minute. The documentation gives only one example, 200 requests. Each integration receives a dated version of the API. Moving to a newer version is optional.
• Exact Online (Dutch vendor, offered in Belgium): OAuth 2.0 and 60 calls per minute and 5,000 per day, per company and per application. Other caps may apply depending on the contract. The token lasts 10 minutes. More than 10 errors per hour on the same endpoint block the key for one hour, then for longer if the errors continue.

Custom-built connector or automation tool: when to use which

Our agents will be written in code, tested and version-controlled. For simple connections, an automation tool may be enough: it links software through ready-made blocks. n8n, for example, offers them for Gmail, Outlook and Odoo.

An automation tool is suitable when the block exists and the action is simple and easy to correct: filing an email, creating a contact.

A custom-built connector is needed when:

• no block exists for your software or your version;
• the action involves money or commits the company: it needs tests, a log of every action and the narrowest possible rights;
• the interface is about to change. The n8n documentation does not say which Odoo interface its block uses. Its source code, read on 13 October 2026, shows it: JSON-2 when connected by API key (Odoo 19 and later), JSON-RPC when connected by password. With Odoo 17 or 18, the block therefore uses JSON-RPC, which is due to be removed with Odoo 22. This code has been published since n8n version 2.23.0, in May 2026.

In both cases, each connector will have a frozen version. An update will go through a short round of acceptance testing, meaning trials before it goes live. We are also preparing automatic reporting: after a repeated error, the connector will open a ticket itself in our support tool, which is also in preparation.

Summary table and date of check

Survey of 12 and 13 October 2026, from the official documentation.

An API changes: we will re-read these pages at every set-up, then during supervision reviews.

Going further

• Our four agents in preparation (emails, payment reminders, quotes, accounting documents): Agents
• The autonomy levels, from observation to supervised autonomy: Method
• The planned monitoring of your agents and their connectors: Supervision
• Where your data goes: Data and security
• Take stock of your tools and their versions: the audit, €490 excl. VAT, deducted from the quote if you sign it within 30 days