API Rate Limiting, Throttling, and Observability

1. Overview & Business Value#

This comprehensive operational guide details the architecture, business workflows, configuration parameters, and execution steps for API Rate Limiting, Throttling, and Observability within SmartERP.

To ensure 99.99% system availability, SmartERP enforces tiered API rate limiting, preventing denial-of-service (DoS) attacks and runaway client scripts.

Rate Limiting Thresholds#

• Standard User API Key: Maximum 120 requests per minute.
• Enterprise Webhook Consumer: Maximum 600 requests per minute.
• Exceeded Limit Response: HTTP 429 Too Many Requests with Retry-After header.

{screenshot:rate-limiting-and-api-monitoring-overview-dashboard}

2. Prerequisites & Security Access Groups#

• Required Modules: base, web, smarterp_core, payment
• Security Groups:
  • Integration Specialist (Technical ID: base.group_user)
  • System Administrator / API Director (Technical ID: base.group_system)
• Master Data Dependencies: Established API keys, configured payment providers, and verified external webhook callback endpoints.

3. Step-by-Step Configuration & Execution#

Step 1: Navigating to the Module Interface#

1. Log into your SmartERP instance at https://smarterp.et/odoo.
2. Open the main App Switcher (grid icon in the top-left corner).
3. Select the Settings app icon.
4. From the top navigation bar, open Technical → Integrations → API Keys / Webhooks.

{screenshot:rate-limiting-and-api-monitoring-app-switcher-navigation}

Step 2: Creating and Parameterizing Records#

1. Click the New button in the top-left control panel.
2. Complete the mandatory fields in the integration form:
   • Endpoint Name (Mandatory): Descriptive identifier for the external client application.
   • Allowed API Scopes (Mandatory): Explicit read/write model permissions.
   • Authentication Mode (Mandatory): Bearer Token, API Key, or HMAC-SHA256 signature.
3. Configure optional parameters: rate limit quotas, IP address allowlists, and retry schedules.

{screenshot:rate-limiting-and-api-monitoring-record-creation-form}

Step 3: Validating and Processing Transactions#

• Execution & Validation: Dispatch test payload from external client tool (cURL / Postman).
• Log Verification: Inspect HTTP response status (HTTP 200 OK) in the API access log.

{screenshot:rate-limiting-and-api-monitoring-transaction-processing-state}

4. Advanced Configuration Points#

• Automated Actions & Scheduled Tasks (Crons):
  • Integration: Clean stale webhook queues (base.ir_cron_webhook_cleanup)
  • Integration: Sync currency exchange rates (base.ir_cron_currency_rates)
• Custom Print Templates & Reports:
  • API Usage & Latency Telemetry Audit Report
  • FinTech Reconciliation & Settlement Statement
• Multi-Company Rules: Record-level security isolation under Company 1 (Ashewa Technology Solutions S.C.).

5. Comprehensive Troubleshooting Matrix#