Brand.YALE_HOME auth seems to have broken recently

[danricho]

Hi,
I've recently found that I keep getting 403 to many of the API endpoints which used to work. I cleared my token cache and now I can't get passed the session creation.

My script to re-create:

from yalexs.api import Api
from yalexs.authenticator import Authenticator, AuthenticationState
from yalexs.const import Brand

api = Api(timeout=20, brand=Brand.YALE_HOME)
authenticator = Authenticator(api, "email", "XXXXX", "YYYYY",
                              access_token_cache_file="yaleAuth.txt")

authentication = authenticator.authenticate()

# State can be either REQUIRES_VALIDATION, BAD_PASSWORD or AUTHENTICATED
# You'll need to call different methods to finish authentication process, see below
AuthenticationState = authentication.state

print(f"AuthenticationState: {AuthenticationState}")

Error:

Traceback (most recent call last):
  File "/pythonApp/yale-lock-data-gatherer/updater.py", line 12, in <module>
    authentication = authenticator.authenticate()
  File "/pythonApp/yale-lock-data-gatherer/venv/lib/python3.9/site-packages/yalexs/authenticator.py", line 79, in authenticate
    response = self._api.get_session(install_id, identifier, self._password)
  File "/pythonApp/yale-lock-data-gatherer/venv/lib/python3.9/site-packages/yalexs/api.py", line 52, in get_session
    return self._dict_to_api(
  File "/pythonApp/yale-lock-data-gatherer/venv/lib/python3.9/site-packages/yalexs/api.py", line 287, in _dict_to_api
    _raise_response_exceptions(response)
  File "/pythonApp/yale-lock-data-gatherer/venv/lib/python3.9/site-packages/yalexs/api.py", line 321, in _raise_response_exceptions
    raise err
  File "/pythonApp/yale-lock-data-gatherer/venv/lib/python3.9/site-packages/yalexs/api.py", line 294, in _raise_response_exceptions
    response.raise_for_status()
  File "/pythonApp/yale-lock-data-gatherer/venv/lib/python3.9/site-packages/requests/models.py", line 1024, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://api.aaecosystem.com/session

[bdraco]

Yes its blocked https://community.home-assistant.io/t/psa-yale-home-integration-blocked-new-integration-coming/762999/17

[danricho]

That thread looks like it is now fixed in the latest version.
I'm not using home assistant, but python direct so I will have to wait for a newer example that is compatible with the newer version of this.

Thanks for the efforts!

[spraot]

@danricho I had to rework my code to run on asyncio instead of threads to get newer versions of this lib working. pubnub still isn't giving me any events though. @bdraco is pubnub working at all, or will I need to migrate to using sockets instead? EDIT: i got pubnub working too now 👍

[danricho]

I was able to get the async version working (as per my code below) - This has unfortunately randomly stopped working for me now (Yale Home).

Here is my code:

import asyncio
from aiohttp import ClientError, ClientSession

from yalexs.api_async import ApiAsync
from yalexs.authenticator_async import AuthenticatorAsync, AuthenticationState
from yalexs.const import Brand

async def make_api():
    return ApiAsync(ClientSession(), timeout=20, brand=Brand.YALE_HOME)

async def make_authenticator(api):
    authenticator = AuthenticatorAsync(api, "email", "MYEMAIL", "MYPW",
        access_token_cache_file="auth.txt")
    await authenticator.async_setup_authentication()
    return authenticator

async def main():
    api = await make_api()
    authenticator = await make_authenticator(api)  
    authentication = await authenticator.async_authenticate()  # It fails here.

    # DO STUFF HERE LIKE GET THE LOCKS ETC... NOT GETTING THAT FAR ANY MORE.

asyncio.run(main())

Here is the error

Traceback (most recent call last):
  File "~/yale-test/venv/lib/python3.9/site-packages/yalexs/api_async.py", line 495, in _raise_response_exceptions
    response.raise_for_status()
  File "~/yale-test/venv/lib/python3.9/site-packages/aiohttp/client_reqrep.py", line 1093, in raise_for_status
    raise ClientResponseError(
aiohttp.client_exceptions.ClientResponseError: 403, message='Forbidden', url='https://api.aaecosystem.com/session'

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "~/yale-test/test.py", line 22, in <module>
    asyncio.run(main())
  File "/usr/lib/python3.9/asyncio/runners.py", line 44, in run
    return loop.run_until_complete(main)
  File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
    return future.result()
  File "~/yale-test/test.py", line 20, in main
    authentication = await authenticator.async_authenticate()  # It fails here.
  File "~/yale-test/venv/lib/python3.9/site-packages/yalexs/authenticator_async.py", line 87, in async_authenticate
    response = await self._api.async_get_session(
  File "~/yale-test/venv/lib/python3.9/site-packages/yalexs/api_async.py", line 102, in async_get_session
    return await self._async_dict_to_api(
  File "~/yale-test/venv/lib/python3.9/site-packages/yalexs/api_async.py", line 487, in _async_dict_to_api
    _raise_response_exceptions(response)
  File "~/yale-test/venv/lib/python3.9/site-packages/yalexs/api_async.py", line 498, in _raise_response_exceptions
    raise InvalidAuth(
yalexs.exceptions.InvalidAuth: Authentication failed: Verify brand is correct: Forbidden
Unclosed client session
client_session: <aiohttp.client.ClientSession object at 0x7f6923317670>
Unclosed connector
connections: ['[(<aiohttp.client_proto.ResponseHandler object at 0x7f69232c78e0>, 4296404.419669244)]']
connector: <aiohttp.connector.TCPConnector object at 0x7f69232b29a0>

[danricho]

I also can't get a verification code:

await authenticator.async_send_verification_code()

Results in:

aiohttp.client_exceptions.ClientResponseError: 403, message='Forbidden', url='https://api.aaecosystem.com/validation/email'

[bdraco]

The key has been retired. You'll need to get a new key from Yale.

[danricho]

Hi @bdraco, which key - is it the HEADER_VALUE_API_KEY in const.py?

[bdraco]

d9984f29-07a6-816e-e1c9-44ec9d1be431 is the retired api key. Its still in use for August/Yale Access (FBIN), but Yale Home (Assa Alboy) no longer uses that key.

You'll have to patch the value with a key you obtain.

[spraot]

@bdraco do you have a contact at Yale for that kind of thing? Their support basically just ignores any requests I make related to their API.

[danricho]

Looks like there will be little chance in getting access via API into the future. From Yale (ASSA ABLOY) Customer Service:

We have recently changed access to our API so it is no longer available for individual users.

The previous functionality of the unofficial yalexs library was a result of the divestiture of the North American Smart Residential Business to Fortune Brands in 2023.

The Yale Home backend now exclusively accepts official Yale Home API keys that are only made available to our partners.

We apologise for any inconvenience that this may cause, but there are no plans to make API keys publicly available again.

😟

[ahnl]

I found this service called Seam to be free for up to 10 locks and it works out of the box.

https://docs.seam.co/latest/device-and-system-integration-guides/yale-locks/get-started-with-yale-locks