Model S REST API

[hans]

Sitting at McD's in Folsom, free WiFi, coffee in hand, debugging my ASCII Charge Monitor, while my Model S is getting a supercharge. Geek life is good.

 

[montgom626]

There is an official app for Android and iOS devices. Search for Tesla in the appropriate app store.

Thanks, I will look. I was hoping for a app for my PC.

 

[zax123]

Sitting at McD's in Folsom, free WiFi, coffee in hand, debugging my ASCII Charge Monitor, while my Model S is getting a supercharge. Geek life is good.

View attachment 17756

That's super cool!

I thought the superchargers were 90kW, why does your app show 159.7kWh?

 

[hans]

I thought the superchargers were 90kW, why does your app show 159.7kWh?

Cause I had kWh and miles/hr mixed up. I did say I was debugging ;-)

 

[finout]

Cause I had kWh and miles/hr mixed up. I did say I was debugging ;-)

Hi Hans,

As an aging computer geek with 30 years of writing software under my belt, I must say I've never had an occasion to run javascript from the command line. I'm assuming you're running the teslacmd.js that you've posted on the GitHub site - what interpreter are you using to run it (and how are you running it from a bash cli without explicitly calling the interpreter?)

 

[rlpm]

Can anyone verify that option_code "CH01" means the car has rear-facing jump seats? What about CH00, is that just the inverse?
I see PureAmps posted CH00 and ClaytonTMC posted CH01.
If you have access to your CH code, please let me know whether you have rear-facing jump seats (or ordered them and they have yet to be installed.

Edit: Never mind. I found this: Tesla Model S Remote Access Protocol - Google Drive
"TR" is third row seating, "CH" is twin (second) charger.

 

[hans]

Hi Hans,

As an aging computer geek with 30 years of writing software under my belt, I must say I've never had an occasion to run javascript from the command line. I'm assuming you're running the teslacmd.js that you've posted on the GitHub site - what interpreter are you using to run it (and how are you running it from a bash cli without explicitly calling the interpreter?)

The interpreter is "node" (node.js). Basically, it's Server-side Javascript. It's all the rage with the kids these days. I'm an old Unix hack so I think of it as the new Perl.

The teslacmd.js file on my laptop is executable ("chmod +x teslacmd.js" in Unix/Linux/MacOS) and the first line of the script is "#!/usr/bin/env node" so the OS runs the script in the node interpreter automatically. You can also type "node teslacmd.js -blah" which would be more clear, but more typing.

I also have a bash alias that automatically adds the --username and --password parameters because I'm lazy, and I don't want my password in my screenshots.

I finished my beta version of the command line charge monitor (see below)

 

[aaron.s]

Hey all you brilliant programmers.....

Are any of you interested in perhaps writing an OSX or Windows application or create a Web Portal application for us non-programmers?

Would really love to access my car from my Mac laptop!

Aaron

 

[inottawa]

Hey all you brilliant programmers.....

Are any of you interested in perhaps writing an OSX or Windows application or create a Web Portal application for us non-programmers?

Would really love to access my car from my Mac laptop!

Aaron

I'd love to take a stab at this, but without a car, I'm coding in the dark with nothing to test against. Hopefully in the next month I'll be able to get something going.

 

[scooterrr]

Hey all you brilliant programmers.....

Are any of you interested in perhaps writing an OSX or Windows application or create a Web Portal application for us non-programmers?

Would really love to access my car from my Mac laptop!

Aaron

I've been thinking about exactly this: in fact, I've bought a domain, have some mockups, and have put up a signup page for people who want to know when there's actually something there - Your Tesla, Everywhere. - Track Your Tesla. Since my car doesn't arrive until Tuesday, I haven't done anything but read the docs and muddle around, but I'm excited to dig more deeply. (I will also replace the Tesla Motors stock photo with something they don't own as soon as I ask someone for permissions to repost one.)

 

[bluetinc]

Hey Aaron,

If you are just trying to get to the car app on your laptop, you can try bluestacks. I have it running on my pc's and works well enough.

Peter

P.S. The picture came in the mail and is fantastic! Thank you so much for it. I'm planning on framing it and putting it up on the wall

Hey all you brilliant programmers.....

Are any of you interested in perhaps writing an OSX or Windows application or create a Web Portal application for us non-programmers?

Would really love to access my car from my Mac laptop!

Aaron

 

[aviators99]

Hey all you brilliant programmers.....

Are any of you interested in perhaps writing an OSX or Windows application or create a Web Portal application for us non-programmers?

Would really love to access my car from my Mac laptop!

Aaron

I have one pretty much complete, but would you trust it? It would require your TM username/password to work. I'm happy to put it out there.

(It's a web app)

 

[adeokar]

Is there a way to get odometer reading using the REST API in stead of the stream API.

 

[PureAmps]

I've been thinking about exactly this: in fact, I've bought a domain, have some mockups, and have put up a signup page for people who want to know when there's actually something there - Your Tesla, Everywhere. - Track Your Tesla.

Proceed with caution. See below.

I have one pretty much complete, but would you trust it? It would require your TM username/password to work. I'm happy to put it out there.

(It's a web app)

Not surprisingly, I'm also working on a web app. Currently for myself only though.

As aviators99 hinted at above, I would recommend some caution for both software developers and owners before everybody decides to go app crazy.

Tesla does not have an official 3rd-party app API with the right security model (e.g. OAuth) in place to truly enable a "safe" 3rd-party application ecosystem. This means an owner must give their My Tesla security credentials to the application provider, who then must store them (in a database) for use by their app. So not only must you trust the app developer will not track your location, honk your horn, unlock your doors, etc., you must also trust that the developer implemented their website security well enough that the stored credentials will not be compromised by some hacker who will then almost certainly use them to track your location, honk your horn, and unlock your doors. I can just see the headline already, "Hackers cause hundreds of Tesla Model S horns to honk simultaneously."

I've had some email conversations with Tesla regarding the API and a formal 3rd party API is on their roadmap. But it is not currently a high priority, given everything else they are working on. Tesla is currently "neutral" on owners using the mobile app API, but the API was never intended for 3rd party use, will not be documented, subject to change at any moment, etc., etc. Their "neutral" stance may change based upon server load, bandwidth usage, etc. I'm sure a major security breach of a 3rd-party web app would change their stance in a hurry.

Having said that, I do believe it is possible to design a safe and secure website using the current API, but it requires some careful thought and planning (equivalent to that of building a PCI-compliant e-commerce site). But I certainly won't be entering my credentials in a random web app that somebody through together over a few weekends.

So app developers/owners, please proceed with caution.

- - - Updated - - -

Is there a way to get odometer reading using the REST API in stead of the stream API.

Not currently.

BTW, the best way to get this added is to email ownership and ask them to add the current odometer reading to the mobile app. Then they will have to add it to the api.

It would actually be useful in the mobile app, because when you go in for service they usually ask for the current odometer reading. You can just whip out the app and show it to them.

 

[rlpm]

Proceed with caution.

I second the above.

 

[scooterrr]

Proceed with caution. See below.

As aviators99 hinted at above, I would recommend some caution for both software developers and owners before everybody decides to go app crazy.

Tesla does not have an official 3rd-party app API with the right security model (e.g. OAuth) in place to truly enable a "safe" 3rd-party application ecosystem. This means an owner must give their My Tesla security credentials to the application provider, who then must store them (in a database) for use by their app.

No argument with any of this. @PureAmps, I was actually going to ping you on whether you'd actually reached out to Tesla on the state of the API, but my assumption would have been exactly what you said.

There are certainly ways to avoid storing credentials in cleartext - in particular, you could hamstring the app by just using the 90-day cookie and require logins on a regular basis, even if it reduces the usability of the app. If the cookie goes down to 1d, of course, you're sunk.

In any case, I would treat my thoughts like your own - primarily interested in self-experimentation or itch-scratching. Perhaps people will have clever ideas that I haven't?

 

[PureAmps]

There are certainly ways to avoid storing credentials in cleartext - in particular, you could hamstring the app by just using the 90-day cookie and require logins on a regular basis, even if it reduces the usability of the app. If the cookie goes down to 1d, of course, you're sunk.

I'm not saying you can't design a safe and secure website. But you have to treat the credentials like you are securing credit card data and all of the best practices that go along with doing so (encrypting data, security/process review, penetration testing, etc.). I would also ask yourself do you want to take on the potential liability that goes along with storing/accessing a user's credentials?

Storing only the cookie (in an encrypted manner) is a good start. But I think you would want to do more and completely isolate the server that relays data from Tesla's servers to your database from any inbound network traffic. The other approach I would consider is to have an owner run an "agent" on their desktop which forwards data to your app. You never need to know/store the user's credentials, you can block data at the agent such as location data, etc. The downside is more complexity, and the user has to run on a computer that doesn't go to sleep often, so a laptop wouldn't work well.

Or, just wait for the 3rd party API...

 

[aaron.s]

Hey Aaron,

If you are just trying to get to the car app on your laptop, you can try bluestacks. I have it running on my pc's and works well enough.

Peter

P.S. The picture came in the mail and is fantastic! Thank you so much for it. I'm planning on framing it and putting it up on the wall

Hi peter!

Glad you got the photo and like it!

I do have blustacks and the android app installed, but was hoping for something more native... But it looks like patience is in order with the discussions of storing & transmitting passwords....

Aaron

 

[aviators99]

I'm not saying you can't design a safe and secure website. But you have to treat the credentials like you are securing credit card data and all of the best practices that go along with doing so (encrypting data, security/process review, penetration testing, etc.). I would also ask yourself do you want to take on the potential liability that goes along with storing/accessing a user's credentials?

Storing only the cookie (in an encrypted manner) is a good start. But I think you would want to do more and completely isolate the server that relays data from Tesla's servers to your database from any inbound network traffic. The other approach I would consider is to have an owner run an "agent" on their desktop which forwards data to your app. You never need to know/store the user's credentials, you can block data at the agent such as location data, etc. The downside is more complexity, and the user has to run on a computer that doesn't go to sleep often, so a laptop wouldn't work well.

Or, just wait for the 3rd party API...

My version does not store the username/password (except in RAM for a couple of seconds). You have to login every time you hit the web page and the only thing it stores after that is the cookie, and it only stores it temporarily.

 

[gg_got_a_tesla]

My version does not store the username/password (except in RAM for a couple of seconds). You have to login every time you hit the web page and the only thing it stores after that is the cookie, and it only stores it temporarily.

Ron, if you get a chance, can you please package this as a distributable of some form and make that available along with instructions (for non-techies too) for how to deploy it?

That way, folks can deploy the web app on their own home/work machines and not worry about going through a third-party deployment and any security issues therein.

You could possibly monetize this too by making it shareware if you prefer; or, simply a voluntary contribution to a PayPal account maybe.