Power BI Connector
This is the installation and configuration guide for Power BI Connector, the module you downloaded from your ECOSIRE dashboard. Everything on this page describes the ecosire_powerbi_connector module exactly as it ships today — the facts below were read out of the released build, not from a roadmap.
| Technical name | ecosire_powerbi_connector |
| Odoo versions | 17.0, 18.0, 19.0, 20.0 (Community or Enterprise) |
| Current maintained build | 17.0 → 17.0.1.1.1, 18.0 → 18.0.1.1.1, 19.0 → 19.0.1.2.1, 20.0 → 20.0.1.2.0 |
| Price | $499 USD — one-time, per Odoo version |
| Odoo module licence | OPL-1 |
| Category | Connector |
A purchase for Odoo 19 unlocks only the 19.0 download — the ZIPs for the other series will not appear in your dashboard. Buy the version you actually run, and if you later upgrade Odoo you need the purchase for the new version. There is no key to enter and no unlock step; this is enforced on the download path.
Dashboard and screen polish on every series.
- Dark mode. The dashboard now follows Odoo's dark mode; before, only the navigation bar turned dark and the cards stayed white.
- Setup guidance. Until a connection works, the dashboard shows how to connect Power BI, with a Set Up Connection button for managers.
- Loading and error states. While the dashboard loads, its sections show placeholders; if loading fails, a banner with Retry appears and each section says its data could not be loaded.
- Semantic rules show their Source Field. The built-in rules are now linked to the field they transform, on install and on upgrade.
- Reports on a phone. Power BI Reports open as cards on small screens.
- Odoo 17: Dataset Blueprints opens. The blueprints screen raised a client error on Odoo 17; it now shows the blueprint cards.
OAuth 2.0 (Delegated) authentication now works.
- Delegated sign-in is implemented. The connection form always offered OAuth 2.0 (Delegated) with a refresh-token field, but earlier builds ignored both and authenticated as the service principal. A tenant that does not permit service-principal API access (the Power BI admin setting Service principals can use Fabric APIs, off by default) can now be connected with a user's refresh token.
- The rotated refresh token is kept. Microsoft issues a new refresh token on every exchange; the module stores it on the connection during the connection test, the test wizard and the hourly token renewal, so you paste it once.
- No silent downgrade. Choosing OAuth 2.0 (Delegated) without a refresh token now stops with a clear message instead of quietly signing in as the application.
- Token Expiry shows the expiry. The field used to hold the moment of renewal; it now holds the token's real expiry time.
On the builds listed above, GET /api/powerbi/v1/<model> (the request Power BI Desktop uses to load the rows of a table) can answer HTTP 403 with "You are not allowed to access 'Power BI Semantic Rule' records". The records are read with the API token's user, but the semantic rules applied afterwards are looked up without that user. The models, schema and count endpoints and the scheduled push to Power BI are not affected. A fix is being prepared for the next update; if you depend on the pull API today, email info@ecosire.com and we will help you set it up.
Explore a fully-populated installation at powerbi.demo.ecosire.com — log in with admin / admin.
What it does
The module connects one Odoo company to one Power BI tenant and gives you two directions of travel:
- Push. Odoo models are published into Power BI push datasets on a schedule you set, so a report refreshes without anyone opening Power BI Desktop.
- Pull. Power BI Desktop loads a whitelisted model over a token-authenticated REST API, running as the token's own Odoo user — your access rights and record rules apply to every read.
Between the two sits the semantic layer: 22 rules shipped across sales, manufacturing, stock, receivables and purchasing resolve technical IDs into names, turn state codes into labels and derive columns such as margin, days overdue and ageing buckets before the data ever leaves your server.
Requirements
- Odoo 17.0, 18.0, 19.0 or 20.0, Community or Enterprise.
- Python 3.10+ with the
msalandrequestslibraries available to your Odoo process. Both are installed by the standard Odoo deployment images; on a bare server,pip install msal requests. - Microsoft. A Power BI workspace on a capacity that permits the operations you need, and an application in Microsoft Entra ID (Azure AD) with a client secret. You need the Tenant ID, Client ID and Client Secret from that application.
- The Power BI admin setting Service principals can use Fabric APIs must be enabled in your tenant if you intend to authenticate as the service principal. It is off by default — if you cannot turn it on, use OAuth 2.0 (Delegated) instead (see below).
Installation
- Install the module from Apps in your Odoo database.
- It depends on
sale,stock,account,mrpandpurchase; install those first if they are not already present. - After installation, the Power BI Connector app appears in the main menu.
Access levels
Two groups ship with the module:
| Group | Can do |
|---|---|
| Power BI Connector / User | Read the dashboard, workspaces, datasets, reports and the API surfaces. |
| Power BI Connector / Manager | Everything a User can, plus: read and change credentials, change the connection, create and revoke API tokens, deploy a dataset blueprint and start a manual sync. |
Membership of Manager is required for every credential read, every connection change, every token generated, every blueprint deployment and every manual sync. A scheduled sync is unaffected — it runs as the system, not as a person.
Connect your tenant
Open Power BI Connector → Configuration → Connection.
| Field | What to put in it |
|---|---|
| Tenant ID | The Directory (tenant) ID of your Entra ID tenant. |
| Client ID | The Application (client) ID of the application you created. |
| Client Secret | The secret you generated for that application. |
| Authority URL | Leave the default (https://login.microsoftonline.com) unless you run a sovereign cloud. A trailing slash is tolerated. |
| API URL | Leave the default (https://api.powerbi.com/v1.0/myorg) unless you target a different Power BI environment. |
| Authentication Method | Service Principal (client credentials) or OAuth 2.0 (Delegated). |
Then press Test Connection. On success the connection state becomes Connected and the acquired token's real expiry is written to the Token Expiry field. An hourly scheduled action renews the token before it expires, so a long-running installation does not need attention.
Service Principal or OAuth 2.0 (Delegated)?
- Service Principal is the usual choice. It authenticates as the application, with no user involved, and is what most tenants use. It requires the Power BI admin setting Service principals can use Fabric APIs to be enabled.
- OAuth 2.0 (Delegated) authenticates as a user, using a refresh token that user obtained from Microsoft. Use it when your tenant does not permit service-principal API access. Paste the refresh token on the OAuth 2.0 tab, choose OAuth 2.0 (Delegated) as the authentication method, and test the connection. Entra ID rotates the refresh token on every exchange; the module stores the new one on the connection automatically, so you paste it once.
If you select OAuth 2.0 (Delegated) without a refresh token the connection is refused, with a message telling you so. It will not quietly fall back to the service principal — a connection you configured for delegated access must not authenticate as the application.
Push datasets on a schedule
Open Power BI Connector → Synchronization → Sync Schedules to create a schedule: which datasets to push, how often, and whether the run is enabled. Each run is recorded in Synchronization → Sync Logs with the records pushed and any error. Every per-record step of a run is contained, so one bad record is reported and skipped rather than aborting the whole push.
Dataset Blueprints (Power BI Connector → Templates → Dataset Blueprints) build a working starting point in one wizard run: six blueprints cover sales through purchasing, check their Odoo prerequisites, and create the dataset, its tables and the first data load.
Serve the pull API to Power BI Desktop
1. Whitelist the models
Open Power BI Connector → API → Endpoints. Eleven models ship pre-whitelisted (sales orders and lines, invoices and lines, purchase orders and lines, manufacturing orders, products, partners, stock moves and quants). Add an endpoint to expose another model. Each endpoint can restrict the fields returned, apply a default domain filter, and cap the number of records a single request may return.
2. Create an API token
Open Power BI Connector → API → API Tokens and create a token. The plaintext is shown exactly once — copy it immediately. Only a SHA-256 hash is stored, together with a twelve-character prefix so you can recognise the token in the list later. Each token has a required Expiration Date and a Run As User: API queries execute with that user's permissions, so give the token a user whose access you are happy to grant to Power BI.
3. Point Power BI Desktop at Odoo
In Power BI Desktop choose Get Data → Web and use the Odoo base URL followed by the endpoint path. Send the token in an Authorization: Bearer <token> header.
| Endpoint | Purpose |
|---|---|
GET /api/powerbi/v1/models | The whitelisted models this token may read, with each endpoint's record cap. |
GET /api/powerbi/v1/<model> | Records for one whitelisted model. Query parameters: limit, offset, fields (comma-separated), domain (extra Odoo domain). The response carries data, total_count, limit, offset and has_more. |
GET /api/powerbi/v1/<model>/schema | Field names with their Odoo type and the matching Power BI type — what Power BI Desktop uses to build the table before loading rows. |
GET /api/powerbi/v1/<model>/count | The total record count for the model, after the endpoint's default domain filter. |
Authentication failures answer 401, and a model that is not whitelisted answers 403 with a JSON error body. No endpoint accepts writes.
4. Let the semantic layer do the tidying
Open Power BI Connector → Configuration → Semantic Rules. Rules apply in sequence to each row before it is returned or pushed, and three types ship: name resolve (turn an ID column into the name a report reader expects), selection label (turn a stored state code into its human label) and computed metric (derive a column with an expression — margin, days overdue, ageing bucket). A rule that fails on a row sets that column to empty and is logged; it never fails the run.
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| Test Connection says the credentials are incomplete | Tenant ID, Client ID and Client Secret are all required. |
| Test Connection fails while your tenant blocks service principals | Enable Service principals can use Fabric APIs in the Power BI admin portal, or switch to OAuth 2.0 (Delegated) with a refresh token. |
A pull answers 401 | The bearer token is missing, revoked, or past its Expiration Date. |
A pull answers 403 | The model is not whitelisted (API → Endpoints), or the token's Run As User may not read it. |
| A pull returns rows but the columns are not what a report expects | Check Configuration → Semantic Rules for the model: a disabled or failing rule leaves the derived column empty. |
| The scheduled push stopped | Read the last entry in Synchronization → Sync Logs — it records the error that stopped the run. |
| Power BI shows stale numbers | The dataset refresh and the schedule are separate: check that the schedule is enabled and its last run succeeded. |
Support
Email info@ecosire.com with your Odoo version, the module version from Apps, and the exact endpoint or screen involved. The module's own changelog ships inside the package as CHANGELOG.md.