Replies: 9 comments
-
|
My goal is to find a way to keep it the commands API alive. How exactly, I don't know at this time. There is a good chance that it will be nonfunctioning for a period of time. I am keeping an eye on the changes Tesla is making and will do what I can. |
Beta Was this translation helpful? Give feedback.
-
|
Breadcrumb: https://github.com/teslamotors/vehicle-command |
Beta Was this translation helpful? Give feedback.
-
|
@brianmay has some good notes on his progress/attempts here teslamate-org/teslamate#3527 When I attempted to sign up for the dev program I saw similar issues to this... teslamotors/vehicle-command#75 --- but its worth noting that I was pointing to endpoints that do not yet exist. I plan to stand those up this weekend. |
Beta Was this translation helpful? Give feedback.
-
|
quick update --- I have successfully registered an app as a developer... teslamate-org/teslamate#3527 (reply in thread) --- which is a step forward... I still hope/plan to keep the command API function alive.. but don't know what it will look like and fully expect it to be broken before I have time to fix it... |
Beta Was this translation helpful? Give feedback.
-
|
I have made little/no progress on this. Safe to say when Tesla makes their changes the command portion of this project will be broken. What little time I have had seems to indicate the path forward is going to be to simply use their API... there are some questions around credential renewal/management (currently handled by Teslamate for TeslamateAPI) |
Beta Was this translation helpful? Give feedback.
-
|
This is my understanding, please correct me if I got anything wrong: The first hurdleWhat exactly is being deprecated? Some web pages suggest that the owners API is being replaced by the fleet API. But other pages have suggested that the REST API (which includes the owners API and the fleet API) will be replaced by the command API - with its ends to end encryption. (note: the command API is actually part of the fleet API) Looking at this information on https://github.com/teslamotors/vehicle-command, I think there are security issues with both the REST APIs, and as a result both of them will eventually get deprecated in favour of the command API which has end to end security. Especially for commands that instruct the car to do anything (I imagine unlock or start car REST APIs might be the first to be deprecated). If so, the minimal solution is to setup their proxy which will continue to support the REST API and translate them. This proxy will do the right thing with older cars and newer cars. The more complete solution - but requires more dev time - is to implement the command protocol and talk to that directly (but note older cars don't support the command protocol and will require the REST API; presumably this will have to be the fleet API not the owners API). I think somebody said that the required protobuf files have been published now, but I haven't looked. The second hurdleTokens that are valid with the owners API cannot be used for the fleet API. To get a token that is valid for the fleet API (and presumably the command API also), you need to register as a developer, object a client_id and client_secret, and then go this process: https://developer.tesla.com/docs/fleet-api#authentication This is fine when you deploy as a proprietary web server, as you can deploy it with secrets. But distributing code (e.g. Android app or Docker image) with these secrets might not be OK. And distributing open source code with these secrets is probably not OK (See 4.5.3 in the terms of use below). The third hurdleIf it is true that we have to use the command API, then this requires generating a private/public key pair, and then distributing that to the cars. Which in turn means registering a domain, setting up a web server, and putting the public key in the appropriate place. https://developer.tesla.com/docs/fleet-api#setup Even then, according to some reports, it doesn't always work. Again, this is easy for a proprietary web server (assuming you trust the security of said server), but not good if you want to distribute code in any form (e.g. open source source software). This private key must be kept secret. Registering as a developerAll of these require registering as a developer. Which means agreeing to the Developer Terms of Use. But some of these terms makes me very uneasy (note: I am not a lawyer). e.g. "4.5.10. Use the API for the development of a competing software product or service." Does this mean if Tesla suddenly decided to buy/build a competitor to TeslaMate, TeslaMate would not be allowed to use the API anymore if we agreed to this? As a result, I have not signed up as a developer. Final notesI guess TeslaMate could setup a proxy somewhere that issues tokens and also gives access to an instance of the command proxy. This would have to be done with a client_secret and a private key that only our proxy has access to. But if somebody got access to the server and stole a private key and outgoing tokens... I don't think we could offer guarantees on security. And that is not good.Actually, on second thoughts, I think this is prohibited by the terms 4.5.21 and 4.5.22. Which would mean that everyone installing Teslamate would have to register as a developer, obtain the client_id and client_secret, generate a private/public key, register their private/public key, keep these secrets... secret, etc. Do we really want to support this? A lot of these issues would also apply equally to the official Tesla mobile app too. If Tesla really got rid of the owners API, they would have to update their app to do something different. And no doubt there are people just waiting to de-compile the app and find out exactly what it is doing. I believe the official Tesla app is still using the owners API... |
Beta Was this translation helpful? Give feedback.
-
|
See in the terms: "4.5.6. Reverse engineer, decompile, disassemble or otherwise attempt to derive or gain access to the API, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation." If you agreed to this, you agreed not to look too much into what the official Tesla mobile app does. |
Beta Was this translation helpful? Give feedback.
-
|
Also in the terms "4.5.20. Use the API or any Application (or attempt to do so) for any automatic or autonomous control of any vehicle behavior or for emergency or life-saving purposes." I suspect the intention here is to rule our anything that attempts to automatically drive the car. Fair enough. I agree that would be bad. But the way it is written, it could apply equally to something that automatically starts/stops charging. I can't agree to that. |
Beta Was this translation helpful? Give feedback.
-
|
over the last few weeks my automation failed so I took some time to look at this this morning. To my surprise... it worked without issue.. 🤷 If y'all are seeing something different I would be glad to understand... --- for me, if it's not broken, I am not going to spend much time fixing it... 😄 @brianmay --- thank you for the insight... |
Beta Was this translation helpful? Give feedback.
-
Thanks for the great tool!
One question:
Do you see any future for TeslamateAPI (esp. the ability to send commands to the soon deprecated RESTful API)?
Beta Was this translation helpful? Give feedback.
All reactions