API Login not working

[hwurst205]

Hi,
great work here.
However, the login process does not appear to be working for my spanet account ("Wrong Login!" result to POST).
Can someone confirm that the API key and password encryption algorithm has not changed?
Thanks
Stefan

[mathieusachet]

Same problem here, and same error with bad api_key, really strange

[dpretty]

It looks like SpaNet have migrated to a new API.

https://app.spanet.net.au/api

There's swagger documentation here https://app.spanet.net.au/swagger/index.html

So far I've only tested the auth endpoint, but was able to get a valid token via:

import json
import requests

username = "my-username@example.org"
password = "my-password"
# I don't know what the validation rules are for the device id, 
# I just used a 16-char hex string for a mock android device id and that worked
device_id = "my-device-id"


url = "https://app.spanet.net.au/api/Login/Authenticate"

headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer ",
}
data = {
    "Email": username,
    "Password": password,
    "UserDeviceId": device_id,
    "Language": "en_AU",
}

response = requests.post(url, headers=headers, data=json.dumps(data))

print(response.json())

[BlaT2512]

Have just investigated and found this too after seeing their new redesigned mobile app. Haven't done any work for a while on this and revisiting it soon, so I will work to recreate this documentation after rewriting my HomeBridge module homebridge-spanet for the new API. Looks like it's going to be a lot nicer to develop from my initial findings that it is using API calls instead of socket for interacting with the spa now?

Also @dpretty the swagger documentation has been made private now (presumably seemed to be accidentally public), you didn't happen to download it did you?

[Eldarion85]

Hello,
I would like to integrate my Vortex Spa into the home automation. I can confirm that it no longer works as in the current documentation.
I use NodeRed and would like to get the current data from the whirlpool from there.

Thanks to the information from @dpretty, I was able to successfully establish a connection and get the following data back on my POST:

first_name: <my first name, which i gave when registering for spanet>
access_token: <272 long token>
refresh_token: <50 long token>
reset_password: false

But what do I do with the token now. The two links from @dpretty above no longer work. I can't find any documentation on how to query data from the hot tub.

[BlaT2512]

@Eldarion85 Your authentication there looks correct, after that you then use the access token in your requests by setting the authentication header in requests to Bearer <access_token>. For example, you can start by making a request to the Devices endpoint to list the devices on your account. The curl below is an example:

curl -X GET https://app.spanet.net.au/api/Devices -H "Authorization: Bearer <access_token>"

If you email my gmail on my account I can reply to you with the full Swagger documentation listing all the endpoints and expected payloads

[dpretty]

@BlaT2512

Also @dpretty the swagger documentation has been made private now (presumably seemed to be accidentally public), you didn't happen to download it did you?

Sorry I missed this notification. I do have a local copy as I guessed it might not remain public...

If you email my gmail on my account I can reply to you with the full Swagger documentation listing all the endpoints and expected payloads

... but it sounds like you have it now anyway?

[BlaT2512]

@dpretty Yes I did get sent it, thanks for your discoveries

[Eldarion85]

@BlaT2512
Many thanks for the quick response!
I just tried it and with the token I get my device details as a reply. Name and MAC match, so it works perfectly.

Now I just need to know the other API addresses, then everything works fine. I will email you directly for documentation.

Thank you both, great work :).

[GuiHue]

@dpretty
Would it be possible to receive a copy of the swagger docs? Love to join the effort!

[GuiHue]

I have since been helped with the documents and have been successful at creating general queries to the api. Need to work with the app some more to find permitted values for various Put and Post commands. Will PR to @dpretty repo.
Thus far I have done everything in plain Python. I have started to play with node-red as developing an entire integration in homeassistant is beyond my skill level (and exceeds the permissible time budget).

In that process I have been wondering: Has anyone worked out:
a) how long the access token is valid?
b) how many api requests per 24h are ok (specially when querying the dashboard)?

Addendum: In answer to myself: "How to work with the refresh_token?"
apiOAuthTokenPost in Docs is the place to look: Send a request with refresh_token and userDeviceID (generated by you, same as during auth) and you get a new token. Now, all that's needed is to work out how long the access_token is good for. Ill give that a short test using a loop.

Adendum 2:
I queried the dashboard for several hours at an intervall of 300s (5'): no complaints.
Furthermore: Access Token seems to be good for at least 24h.

[GuiHue]

Updates:
I did 120 Minutes of continuous QUerys to the Dashboard at Intervalls of 60s without complaints
I have been using the same access_token since 36h by now.

[GuiHue]

Hi all,
some progress over time: I managed to implement all GET functions via node-red and transfer the results to homeassistant. Thats good - BUT:
The SmartlInk app and the API server have become unresponsive several times throughout the last week. Often for multiple hours. I dont think it is throttling towards my account or IP, but rather a general problem.
Can anyone confirm?

[Eldarion85]

Hello,

thanks for your research @GuiHue.
Unfortunately, I have only tested a few GET queries with Node-RED so far to see if it basically works. Unfortunately, I can't yet answer how long the access token is valid and at what intervals you can query it.

I currently have everything disabled because I found out with Wireshark that the spa link has a bug when setting it up. The DHCP exchange with the DHCP server is faulty and does not work with more expensive DHCP servers that value security.
DHCP Discovery (from client) and DHCP Offer (from server) are OK, but then the client sends a wrong DHCP request to the server, so better DHCP servers do not assign an IP address and reject the connection.
This probably affects all Spa-Link devices on the market and I am in contact with the manufacturer.

Only after clearing that up will I get back to the API and share my information here.