SCENIC : Error: ('err.func.wired.forbidden', 'The access is forbidden')

[remo-tech]

Hello,
I am trying to use this api to control the new Renault Scenic , I got the error :

$renault-api charge start
Error: ('err.func.wired.forbidden', 'The access is forbidden')

And he log :

2024-10-10 17:12:32,076 - renault_api.kamereon - DEBUG - Received Kamereon response 403 on GET to https://api-wired-prod-1-euw1.wrd-aws.com/commerce/v1/accounts/XXXXXXXXXXXXX/kamereon/kca/car-adapter/v1/cars/VF1XXXXXXXXXXX/charge-mode?country=FR: {"type":"FUNCTIONAL","messages":[{"code":"err.func.wired.forbidden","message":"The access is forbidden"}],"errors":[{"errorCode":"err.func.wired.forbidden","errorMessage":"The access is forbidden"}],"error_reference":"FUNCTIONAL"}

Any idea how to fix that ? The feature to start charging is working fine from the MyRenault app.

[epenet]

Sadly the Renault API is fully undocumented.
Hopefully someone can work out which endpoints get called - with what parameters...

[remo-tech]

Any clue on how I can to help find the endpoint / parameters ? Any documentation on how the current API was discovered ?

[d4icon]

As I said in the other repository:

To discover the endpoints and the parameters that are sent and received, I managed (after several days) to set up an android emulator with the Renault application.
Thanks to Frida, HttpTookit and (above all) to some scripts that I found how to bypass the ‘certificate pinning’ I managed to capture all the traffic of the application.
I've tried with a secondary account and it works.

The problem is that I'm afraid to add my car account, which is the one we are interested in to capture the call in question.

So my doubts are, @epenet

-Do you know if there could be any kind of blocking of the account if they detect something?
-Do you know if using your python application in console-cli can also cause some kind of temporary or indefinite ban?

In short, I'm a bit ‘afraid’ to use my original account, both for my testing environment and for yours.

Give me more information on this, to see if I can do a final test.

[epenet]

To discover the endpoints and the parameters that are sent and received, I managed (after several days) to set up an android emulator with the Renault application. Thanks to Frida, HttpTookit and (above all) to some scripts that I found how to bypass the ‘certificate pinning’ I managed to capture all the traffic of the application. I've tried with a secondary account and it works.

Originally it was much easier - I gave up when they went with certificate pinning.
If you have some time, it might be nice if you add a small guide to show how you managed it.

-Do you know if there could be any kind of blocking of the account if they detect something?
-Do you know if using your python application in console-cli can also cause some kind of temporary or indefinite ban?

They have rate-control in place, so if you do too many tests in a short time you may get rate-limited for a few hours.
I suggest to close the phone app and disable in HA while you make some tests

[d4icon]

To discover the endpoints and the parameters that are sent and received, I managed (after several days) to set up an android emulator with the Renault application. Thanks to Frida, HttpTookit and (above all) to some scripts that I found how to bypass the ‘certificate pinning’ I managed to capture all the traffic of the application. I've tried with a secondary account and it works.

Originally it was much easier - I gave up when they went with certificate pinning. If you have some time, it might be nice if you add a small guide to show how you managed it.

-Do you know if there could be any kind of blocking of the account if they detect something?
-Do you know if using your python application in console-cli can also cause some kind of temporary or indefinite ban?

They have rate-control in place, so if you do too many tests in a short time you may get rate-limited for a few hours. I suggest to close the phone app and disable in HA while you make some tests

I'm going to prepare everything again, since it's been a few weeks since the tests, and anyway, as you know it's a bit complex at the beginning, and I need to remember some things again.

Once I have it all working again .... I don't know where to share this with you. You tell me... I don't know if some things can be put here.
Let me know
Best regards

[remo-tech]

Ok I may have found something to help. I have decompiled the Android apk , and found a "ChargeEndpoint" class that seems to contains all endpoints linked to charge :

Here is the list :

GET : 
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/battery-inhibition-status
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charges
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charge-mode
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charge-schedule
/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/settings
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charge-history?type=month

POST :
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/actions/charge-mode
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/actions/charge-schedule
/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/schedule
/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/start

The charge/start endpoint seems different than the one use in renault-api , could this help you fix the problem ? Any clue on how to test this ?

[d4icon]

Ok I may have found something to help. I have decompiled the Android apk , and found a "ChargeEndpoint" class that seems to contains all endpoints linked to charge :

Here is the list :

GET : 
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/battery-inhibition-status
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charges
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charge-mode
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charge-schedule
/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/settings
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/charge-history?type=month

POST :
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/actions/charge-mode
/commerce/v1/accounts/{id}/kamereon/kca/car-adapter/v1/cars/{vin}/actions/charge-schedule
/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/schedule
/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/start

The charge/start endpoint seems different than the one use in renault-api , could this help you fix the problem ? Any clue on how to test this ?

At first glance, it looks good...
Maybe it would be quicker right now to do a test with renault-api testing those enpodint.

[remo-tech]

So quick update, I have tried to modify renault-api locally to test 2 things. But at this point , all my attempts are unsuccessful ..

1 - Adding

  "XCB1SE": {  # SCENIC E-TECH
        "control-charge-via-kcm": True
    },

in models.py
=> Still 403

2- Changing endpoint to point to

/commerce/v1/accounts/{id}/kamereon/kcm/v1/vehicles/{vin}/charge/start

int renault_vehicle.py
=> Still 403

I will continue to investigate, but maybe there is something else that need to be done to get the access rights ?

[remo-tech]

Soo, I think I found the solution looking at the Android app logs : When I click the button "Start Charge" on the app, there is no specific request for this, but there is a request that change the charging schedule. It just set all programActivationStatus to false if they are True .

The request seems to wake up the vehicule, than if it is plugged in , it will start charge.
I think that there is no way to stop a charge at this point.

Here is an exemple that will work for on my Scenic E-TECH to wake it up, and start charging.

renault-api --log http  post-file "/commerce/v1/accounts/{account_id}/kamereon/kcm/v1/vehicles/{vin}/ev/settings?country=FR" .\settings_request.json

settings_request.json :

{
	"lastSettingsUpdateTimestamp": "2024-10-17T11:27:42.928046Z",
	"chargeModeRq": "SCHEDULED",
	"chargeTimeStart": "09:00",
	"chargeDuration": 600,
	"preconditioningTemperature": 21.0,
	"preconditioningHeatedStrgWheel": false,
	"preconditioningHeatedRightSeat": false,
	"preconditioningHeatedLeftSeat": false,
	"programs": [
		{
			"programActivationStatus": false,
			"programType": "CHARGE",
			"programDepartureTime": "11:00",
			"programActivationMonday": true,
			"programActivationTuesday": true,
			"programActivationWednesday": true,
			"programActivationThursday": true,
			"programActivationFriday": true,
			"programActivationSaturday": true,
			"programActivationSunday": true
		},
		{
			"programActivationStatus": false,
			"programType": "CHARGE",
			"programDepartureTime": "13:00",
			"programActivationMonday": true,
			"programActivationTuesday": true,
			"programActivationWednesday": true,
			"programActivationThursday": true,
			"programActivationFriday": true,
			"programActivationSaturday": true,
			"programActivationSunday": true
		},
		{
			"programActivationStatus": false,
			"programType": "CHARGE",
			"programDepartureTime": "15:00",
			"programActivationMonday": true,
			"programActivationTuesday": true,
			"programActivationWednesday": true,
			"programActivationThursday": true,
			"programActivationFriday": true,
			"programActivationSaturday": true,
			"programActivationSunday": true
		}
	]
}

The thing is if we want to integrate this, the request need to first GET the settings, then POST the modified result to ensure no setting is lost (that is what is done on the MyRenault)

I could try to integrate this into renault-api for the scenic only, but I am not sure what is the best way ? With a specific setting for the Scenic ? A totally different command ?

@epenet , any preferences ?

[d4icon]

Soo, I think I found the solution looking at the Android app logs : When I click the button "Start Charge" on the app, there is no specific request for this, but there is a request that change the charging schedule. It just set all programActivationStatus to false if they are True .

The request seems to wake up the vehicule, than if it is plugged in , it will start charge. I think that there is no way to stop a charge at this point.

Here is an exemple that will work for on my Scenic E-TECH to wake it up, and start charging.

renault-api --log http  post-file "/commerce/v1/accounts/{account_id}/kamereon/kcm/v1/vehicles/{vin}/ev/settings?country=FR" .\settings_request.json

settings_request.json :

{
	"lastSettingsUpdateTimestamp": "2024-10-17T11:27:42.928046Z",
	"chargeModeRq": "SCHEDULED",
	"chargeTimeStart": "09:00",
	"chargeDuration": 600,
	"preconditioningTemperature": 21.0,
	"preconditioningHeatedStrgWheel": false,
	"preconditioningHeatedRightSeat": false,
	"preconditioningHeatedLeftSeat": false,
	"programs": [
		{
			"programActivationStatus": false,
			"programType": "CHARGE",
			"programDepartureTime": "11:00",
			"programActivationMonday": true,
			"programActivationTuesday": true,
			"programActivationWednesday": true,
			"programActivationThursday": true,
			"programActivationFriday": true,
			"programActivationSaturday": true,
			"programActivationSunday": true
		},
		{
			"programActivationStatus": false,
			"programType": "CHARGE",
			"programDepartureTime": "13:00",
			"programActivationMonday": true,
			"programActivationTuesday": true,
			"programActivationWednesday": true,
			"programActivationThursday": true,
			"programActivationFriday": true,
			"programActivationSaturday": true,
			"programActivationSunday": true
		},
		{
			"programActivationStatus": false,
			"programType": "CHARGE",
			"programDepartureTime": "15:00",
			"programActivationMonday": true,
			"programActivationTuesday": true,
			"programActivationWednesday": true,
			"programActivationThursday": true,
			"programActivationFriday": true,
			"programActivationSaturday": true,
			"programActivationSunday": true
		}
	]
}

The thing is if we want to integrate this, the request need to first GET the settings, then POST the modified result to ensure no setting is lost (that is what is done on the MyRenault)

I could try to integrate this into renault-api for the scenic only, but I am not sure what is the best way ? With a specific setting for the Scenic ? A totally different command ?

@epenet , any preferences ?

Interesting,
Thanks @remo-tech

On the other hand .... I understand that when you press the ‘load button’ in the application, in case you have ‘timetable schedules’ you are warned that all of them will be deleted. Can it be related to what you say?

On the other hand... You say you can't stop the upload?
There is a button for that... no? It works for me in the mobile app.

[remo-tech]

On the other hand .... I understand that when you press the ‘load button’ in the application, in case you have ‘timetable schedules’ you are warned that all of them will be deleted. Can it be related to what you say?

You mean the button to start the Charge ? Yes it disables all schedules (they are not deleted , just disabled)

On the other hand... You say you can't stop the upload? There is a button for that... no? It works for me in the mobile app.

If you mean stop de charging process, I personally don't have any button to do so on the MyRenault app for the Scenic. There is button to start, but if the vehicule is currently charging, there is no button to stop it....

[d4icon]

On the other hand .... I understand that when you press the ‘load button’ in the application, in case you have ‘timetable schedules’ you are warned that all of them will be deleted. Can it be related to what you say?

You mean the button to start the Charge ? Yes it disables all schedules (they are not deleted , just disabled)

On the other hand... You say you can't stop the upload? There is a button for that... no? It works for me in the mobile app.

If you mean stop de charging process, I personally don't have any button to do so on the MyRenault app for the Scenic. There is button to start, but if the vehicule is currently charging, there is no button to stop it....

oops...
really?
are you on the latest version (with the skin change) of the application?

I think that's why
In the previous one it was there, button to load and button to stop.

[remo-tech]

oops... really? are you on the latest version (with the skin change) of the application?

I think that's why In the previous one it was there, button to load and button to stop.

Yes latest version. The previous version had a toggle I think, but I am not sure it was really working ...