Odoo19 create attachment

[StefanKnoebl]

Describe the problem/error/question

When using the Odoo node (resource: custom, model: ir.attachment) in create or update operations, the node sends incorrect data to Odoo or transforms it internally in a way that causes Odoo to reject the request with a permission denied / access error.

I verified this by sending the exact same JSON-RPC request from Postman.
➡️ Postman works 100% correctly
➡️ n8n Odoo node fails with “not permitted to access this document”.

This proves that the issue is not in Odoo, not in permissions, not in my API user, not in the database, but in how the n8n Odoo node serializes the request.

Specifically:

Creating an attachment works when res_model and res_id are NOT included.

The moment res_model = "product.template" and res_id = <valid_id> are included, the Odoo node returns an error — while the exact same payload works in Postman.

Using an HTTP Request node with JSON-RPC works perfectly, confirming the Odoo API behaves correctly.

This strongly indicates that the Odoo node is building malformed JSON-RPC bodies, mixing fields, or sending parameters in the wrong array positions for execute_kw calls.

What is the error message (if any)?

The Odoo node returns:

Tut uns leid, Sie sind nicht berechtigt auf dieses Dokument zuzugreifen.

Translated:

“Sorry, you are not allowed to access this document.”

However, this is misleading, because:

The exact same JSON-RPC request succeeds when executed from Postman.

The API user has full permissions.

The attachment can be created + linked manually inside Odoo with no access issues.

The JSON-RPC request executed via a normal HTTP node inside n8n also works.

So the Odoo node is the only component producing the error.

Please share your workflow/screenshots/recording
Odoo Node used for ir.attachment.create:
{
"resource": "custom",
"customResource": "ir.attachment",
"fieldsToCreateOrUpdate": {
"fields": [
{ "fieldName": "name", "fieldValue": "={{ $('When Executed by Another Workflow').item.json.Name }}" },
{ "fieldName": "datas", "fieldValue": "={{ $('Extract from File1').item.json.data }}" },
{ "fieldName": "res_id", "fieldValue": "={{ $('When Executed by Another Workflow').item.json['Res id'] }}" },
{ "fieldName": "type", "fieldValue": "binary" },
{ "fieldName": "res_model", "fieldValue": "product.template" }
]
}
}

This node fails, even though the exact same JSON-RPC request works via HTTP.

Full node export (sanitized)

Share the output returned by the last node
NodeApiError: Tut uns leid, Sie sind nicht berechtigt auf dieses Dokument zuzugreifen.
at ExecuteContext.odooJSONRPCRequest (...)
at ExecuteContext.odooCreate (...)
at ExecuteContext.execute (...)

This error disappears immediately when calling Odoo via raw JSON-RPC, meaning this is not an Odoo-side restriction.

Why I am sure this is an n8n Odoo-node bug

1. Raw JSON-RPC via Postman works

When I send:

{
"jsonrpc": "2.0",
"method": "call",
"params": {
"service": "object",
"method": "execute_kw",
"args": [
"DB",
USER_ID,
"API_KEY",
"ir.attachment",
"create",
[
{
"name": "...",
"datas": "...",
"type": "binary",
"mimetype": "application/pdf",
"res_model": "product.template",
"res_id": 12
}
]
]
},
"id": 1
}

Odoo responds correctly with a created attachment ID.

2. Doing the very same request via n8n HTTP Request node also works

Meaning the Odoo API behaves correctly.

3. Only the built-in n8n Odoo node fails

Which means:

The node transforms the request incorrectly

OR mixes parameters

OR alters the JSON-RPC structure internally

OR maps incorrect fields (e.g., wrong res_id, wrong arg order)

This matches other known issues with the n8n Odoo node.

Debug info
core

n8nVersion: 1.121.3

platform: docker (self-hosted)

nodeJsVersion: 22.21.0

nodeEnv: production

database: postgres

executionMode: scaling (single-main)

concurrency: -1

license: community

storage

success: all

error: all

progress: false

manual: true

binaryMode: memory

pruning

enabled: true

maxAge: 336 hours

maxCount: 10000 executions

Summary

➡️ Odoo works
➡️ JSON-RPC works
➡️ HTTP Request node works
❌ Odoo node does NOT work even with the same parameters

The issue seems to be in how the Odoo node builds JSON-RPC calls, especially when setting res_model and res_id.

I need the n8n team to review whether:

the Odoo node constructs the JSON-RPC execute_kw call correctly,

field mappings are correct,

array ordering matches the Odoo XML-RPC/JSON-RPC specification,

or whether this is a known issue in the 1.12x line.

Generated at: 2025-11-30T16:00:58.217Z}