Climate Solutions Community

@eweri I think you're missunderstanding what does the vitoconnect was designed for. It was not about accessing our heating data every minute. It was a way to feed ViCare application and so provide us a way of controlling our heating system and do some human monitoring. We have hijacked this for home automation but it was not what exactly what Viessmann sold to us.... I find that Viessmann is quite comprehensive. They could have just prevent every usage that it's not human driven by setting a treshold much more lower. However, I hope they will hear for the need in mid-term to get local access to our data. ... Mehr anzeigen

For information, If you put all your 7 reading into a single php file this will only generate one request for all. ... Mehr anzeigen

@MichaelHanna I confirm this is working again on my system. Thanks to all the dev team who fixed this very quickly and to you that had to support our "anger" 🙂 I have been able to test my refactoring and now every cron trigger will only result in 4 request (independently of the amount of data to retrieve). Regards ... Mehr anzeigen

I have shut down my client for 2 days... Today I have been banned with a single request 😃 ... Mehr anzeigen

It was indeed only a guess and only dev from viessmann have access to log and are able to diagnose the problem. It's a pretty good news if you have found something that could fix the problem. How about adding this in your main post ? ... Mehr anzeigen

@Zbig teck toi for sharing about vitoguide. I wasn't aware of this. I confirm I have access tomy own installation. I even found the interface is way better than the vicare application. But why do they provide 2 ways of exposing data? ... Mehr anzeigen

@MichaelHanna This is really problematic as we can't diagnose the problem easily because the ban is soooo long for a single attempt. Could you just suspend this filter so dev can check what's wrong in an efficient way ? ... Mehr anzeigen

hum still beeing banned even after trying this trick.. ... Mehr anzeigen

For your workaround do you have to scan the qr code for the registration to fail ? ... Mehr anzeigen

You receive a token after the authentication. This token grant you access to your date. ConsumerId and ConsumerSecret are supposed to be static credentials for the Vicare app. I have the feeling indeed that the count could be shared among every user. Maybe it's coming from my way of coding or from a problem with the viessmann's server ... Mehr anzeigen

Ok I had my account back, check with ViCare, run one call and then boom 24hour ban. There is something else that cause the ban. Maybe that it's a problem with my way of coding the client. I wonder if it's possible that every user is using the same "credentials" to access the service leading to this situation. That could explain the problem. I will investigate in that way. Basically the request that cause the ban was : https://api.viessmann-platform.io/operational-data/installations/<intallation_id>/gateways/<gateway_id>/devices/0/features/general-management/installations with those data CONSUMERID = "79742319e39XXXX1d15ff4cac2a8"; CONSUMERSECRET = "8ad97acXXXXXb093c7c083fa"; x-api-key=token 38c97795ed8aXXXXX447bd1178c8 ... Mehr anzeigen

Well I have reverse-engineered the current service behind ViCare and developped a low level client in php(what an idea....). If I had to do it once again then it would do an openapi rest interface wich is more than likeley what Viessmann will provide. So I think it will be more efficient to wait their dev portal tbh. ... Mehr anzeigen

BTW I have developped a version of my code that sould do caching and so reduce load on server. ... Mehr anzeigen

Well MichaelHanna is partially right about this. We have hijack the server wich was designed to be used for a SPA application like ViCare with very little load planned. So they have indeed no obligation to do anything to support this. However, I had to do this dev because during summer 2018 Viessmann broke it's own ViCare application by upgrading the server api without coordinatation with the app dev teams. ViCare was completely useless and since it was no more possible to get basic information through ViCare I have done this code. So that's not for the fun I have started my own dev but because there was no official way to access my own data.... After that, the api has been used(even by mysfelf) to keep track of data but indeed the service wasn't design for this. So yes you don't have any obligation and I do appreciate you're tollerating our usage but don't forget we had to find a workaround due to Viessmann's failure during summer 2018... ... Mehr anzeigen

I didn't feel aimed by your comment, don't worry. I was just providing a plausible explanation. In fact, if someone could provide me the clientId/secretId of the IOS App this would help me to confirm/infirm my hypothesis. ... Mehr anzeigen

clientId/secretId(of the app) are more than likely different on IOS and Android... I'm using the secretId from Android ViCareApp in my client of the service... ... Mehr anzeigen

ban last 24 hour.... ... Mehr anzeigen

How about suspending this treshold in production environment and do your test in the decicated test/acceptance environment as every professional company does for their IT ? Is that your way to do to test directly in in production ? ... Mehr anzeigen

Well Before 11 AM 17 marchi I was doing every 5 minutes this list of call: - active mode - active program - outside temperature - heating burner status - HotWaterStorageTemperature - Boiler temperature - normal program temperature - reduced program temperature - slope & shift - DHW schedule - Heating scheduleA - Room temperature Every call first do an authentication, then do a call to general-management/installations andoperational-data/installations/gateways/gatewayId /devices/device_id/features. I would say 12 authentication and 24 call to the API every 5 minutes this lead me to be ban today. HOWEVER, I have disable all of those call on 11 AM this morning(17 march). I got my access back at 17h20 and did some manual call to test my refactoring. I have done during 30 mintes 2-3 calls to get curve information 10 call to "general-management/installations" and "operational-data/installations/gateways/gatewayId /devices/device_id/features". That's all. And I have being ban again. The lock is weird. The lock today was release on Tuesday, March 17, 2020 5:20:10.106 PM The new one was set on Wednesday, March 18, 2020 5:23:42.988 PM So it took me less than 4 minutes to be blocked !!! Moreover, I didn't test it in this timeframe... Here is a received message right now: {"viErrorId":"req-4485c64081604168a4ae9220d192fe8e","statusCode":429,"errorType":"RATE_LIMIT_EXCEEDED","message":"API calls rate limit has been exceeded. Please wait until your limit will renew.","extendedPayload":{"name":"ViCare day limit","requestCountLimit":1450,"clientId":"79742319xxxxxxxxx2a8","userId":"d61aexxxxxxxxxx-xxxx-7a492bb94efb","limitReset":1584548622988}}   ... Mehr anzeigen

Either they are doing certificate pining ie trust directly the leaf certificate not a CA but then certificate as to be renew or have very long validity time. You would have to change the leaf certificate in the vitoconnect code to be able to do a mitm. Either they are doing classical certificate validation with their own CA signed by a well known Root CA(GlobalSign,VerySign) or Self-Signed. You would have to add a custom CA to the OS to be able to forge the leaf certificate. That's what I did with the ViCare App by adding the mitm CA in the truststore of my smartphone. I know that some app are using a vpn to do a mitm(packet capture on android) but not quite sure how they are doing. ... Mehr anzeigen

Since they are working more than likely on Azure Api Gateway let's just check how to implement this ;-). I will ask tomorow to my colleague who is in charge of the Api Gateway(also Azure) to get more detail about the WAF(Web Application Firewall). ... Mehr anzeigen

You could only mitm if you had access to the list of trusted certificate that the Vitoconnect trust and add a mitm CA certificate. Then the mitm server would forge a fake Viessmann's certificate and so allow you to decode ssl. However, I didn't find any way to access to the Vitoconnect with a telent/ssh session and change the certificate "truststore". ... Mehr anzeigen

Ok but then the ban must also be a moving window, not a fixed 24 hours... ... Mehr anzeigen

Ok I get back my account for an 1 hour... I have disabled the cron and did at most 10 call but I'm banned again till tomorow 17h24pm..... Even with my cron enabled it won't be possible to reach 1450 request in 1h30m...  So either someone else is using my account, either your count doesn't reset to 0 on the due time.... It's very frustrating while I'm trying to refactor the code of the my api client to reduce load and prevent some of your user to be blocked....  ... Mehr anzeigen