A controller route is a web endpoint, but not every endpoint serves a web page to a person. Some are for programs. This piece is about JSON and RPC routes in Odoo.
Two kinds of endpoint
A controller route is a web endpoint Odoo responds to, but there are, broadly, two kinds of thing an endpoint can be for. An endpoint can serve a web page, something for a person, in a browser, to see. Or an endpoint can be for a program, something that another program calls, programmatically, to exchange data, not something a person views. JSON and RPC routes are the kind of route for the second case: routes meant for programs to call.
What JSON and RPC routes are
A JSON or RPC route is a controller route built to be called by a program rather than viewed by a person. Where a route serving a web page produces a page for a person, a JSON or RPC route exchanges data with a calling program: the program calls the route, perhaps sending data, and the route responds with data, in a form a program works with. JSON and RPC routes are, in essence, the programmatic endpoints, the routes for program-to-program interaction rather than page-serving.
What JSON and RPC routes are for
JSON and RPC routes are for the cases where Odoo needs to interact with a program, not serve a person a page. They are used within Odoo itself, for the programmatic interaction Odoo's own parts have. And they are relevant to integration: where a developer builds a way for external software to interact with Odoo through custom endpoints, those endpoints are this programmatic kind of route. A developer building anything where Odoo exchanges data with a program, rather than serving a page, works with JSON or RPC routes.
JSON and RPC routes are still web endpoints
An honest, important note. A JSON or RPC route, though it is for programs rather than people, is still a web endpoint, still something reachable over the web. So, like any controller route, it has to be considered for security: who, or what, should be able to call it, and the route secured so that only what should call it can. A programmatic route is not exempt from the security care every controller route needs; it is exposed like any endpoint, and a developer building a JSON or RPC route must consider and ensure its security.
The takeaway
JSON and RPC routes in Odoo are controller routes built to be called by programs rather than viewed by people: where a page-serving route produces a page for a person, a JSON or RPC route exchanges data with a calling program. They are for the cases where Odoo interacts with a program, used within Odoo and relevant to building custom endpoints for integration. A JSON or RPC route is still a web endpoint, so, like any controller route, it must be considered and secured for who or what should be able to call it. For how we approach Odoo, see our ERP practice.