8 ms·
Unofficial documentation of the Tesla Model S REST API
- ge0rg 14y agoWow, finally a way for us nerds to interact with our cars, besides of hunting undocumented CAN bus commands via OBD2!
- rescovi 14y agoWould also be nice if we had publicicly available IVI computers with proper car APIs to tinker and play with. Any ideas if there are other available than upcoming Tizen IVI reference hardware (which is not yet available for 2.0 afaik)?
- alexjeffrey 14y agoI hate to think what would happen if tesla's user database was hacked. Not that that's a reason not to have a REST API of course, I hope to see a lot of car-app innovation come from this!
- ekurutepe 14y agoDo the cars have an onboard wifi for the server-client communication? Is this API also open to the Internet over the car's cellular connection? (if there is one of course)
- timdorr 14y agoIt's over 3G for now. There is wifi hardware in the car, but they haven't built out an interface for it yet. All Model S's come with 3 months of cell service and they will be offering data plans shortly. It's running on AT&T, so we should be able to add it to Mobile Share plans (which I plan to do).
- toomuchtodo 14y agoIs the SIM soldered? Or can you drop a T-Mobile SIM card in? /T-Mobile user
- sahaskatta 14y agoI looked around and didn't see a SIM slot. Tesla hasn't disclosed the carrier in use either. They did however say that you'll be able to tether a phone with a data connection to the car via USB to avoid paying a subscription for the car.
- toomuchtodo 14y agoI don't mind paying the subscription; I just hate AT&T with the passion of ten fiery hells.
- dochtman 14y agoUsing GET to trigger horn honking... Not sure I'd consider that good REST practices. (At least honking the horn doesn't incur permanent state change; unlocking the doors is obviously not safe.) Edit: idempotency vs safety... I knew I was being stupid.
- damon_c 14y agoJust think of what a single index crawler could do to this car!
- parfe 14y agoUnlocking doors absolutely is idempotent. What different state would you see if you issue Unlock once or a thousand times?
- jws 14y agoSolenoid melted?
- joezydeco 14y agoThinking like an embedded systems engineer (I am) instead of a mathematician (I'm not), I would have a sensor to know the state of the lock and only whack the unlock solenoid if the lock has been discovered to be closed. Always treat mechanical devices in a non-deterministic fashion.
- DoubleCluster 14y agoAs a software developer I'd always try to unlock it. The user probably has a reason for pressing the button. Maybe your "is the door locked" sensor is broken? If you're afraid of overheating it wait a bit after the second try before enabling it again.
- jrabone 14y agoYou might be surprised by the semantics assigned to double clicking the button by some manufacturers. On some BMWs (mine included) locking it twice DISABLES the alarm. It's intended for ferries / low-loader recovery etc. but if you don't know it...
- nathan_long 14y agoWhat I would like to see is USB plug in every car, which provides diagnostic and maintenance data according to a standardized format. This should be available to the owner and to any shop they authorize to work on the car.
- timdorr 14y agoThere's actually this sort of thing in the car via the touchscreen. If you hold down on the "T" at the top center of the screen, it will prompt for an access PIN and behind there is all the diagnostics you could dream of. Unfortunately, that's all hidden from the consumer for now :/
- drzaiusapelord 14y agoThe OBD2 standard does this today. Not pretty, but works well enough. I always check my fault codes before going to the mechanic. >which provides diagnostic and maintenance data according to a standardized format. Except the values you get won't make any sense outside of your particular model. Its like reading SMART data from a hard drive. Okay, you can generate this csv and have all this data, but without the manufacturer telling what thresholds matter (and these are arguable), its kinda meaningless. SMART was supposed to predict failures and do all sorts of things, but its kind useless in practice. I think most controllers just stupidly rely on bad blocks appearing than trying to interpret the tea leaves of SMART data. With OBD systems, all this information is internal and we get a fault code when we pass a certain threshold. I think this makes it a lot easier for mechanics and lay people to work with. Data addicts, of course, will never be satisfied unless they can pull every bit out of the system, but that may not be practical or useful. I could see a hybrid system where a car has the old fashioned OBD2 protocol and something else for nerds to download.
- timdorr 14y agoDocs are here: http://docs.timdorr.apiary.io/ http://docs.timdorr.apiary.io/ This was discovered via the Android app in particular: https://play.google.com/store/apps/details?id=com.teslamotors.tesla https://play.google.com/store/apps/details?id=com.teslamotor... I did some sniffing on the traffic, which is SSL encrypted, but luckily it's pretty easy to install your own CA in Android 4.1+. They have both a Rails app and a nodejs server. The nodejs server is for live streaming car location and driving metrics. I haven't gotten that documented yet (but I'm accepting pull requests!), but some people have already been making use of it: http://www.teslamotorsclub.com/showthread.php/13410-Model-S-REST-API http://www.teslamotorsclub.com/showthread.php/13410-Model-S-... One guy already has his Model S tweeting: https://twitter.com/pureamps https://twitter.com/pureamps
- wubbfindel 14y agoRe:tweeting model s. Who would have thought that Knight Rider's Kit would be so into social networking?
- Almad 14y agoThanks for this awesome work ;)
- HorizonXP 14y agoIf I had a Model S, I'd write a BlackBerry 10 app using this. Kudos to you for this work!
- HorizonXP 14y agoAnd it looks like someone did it! http://appworld.blackberry.com/webstore/content/23977878/?countrycode=US http://appworld.blackberry.com/webstore/content/23977878/?co...
- owenfi 14y agoI love Tesla, and the Model S seems great, but having a rails app server on my luxury car seems capricious. How does it get updated? An attacker can at least unlock the doors or drain the battery (lights & HVAC control), and possibly it is an entry point for something much worse (unlocking & starting, or disabling controls while enroute). Is this a major security flaw or am I just spreading FUD?
- beaumartinez 14y agoDoes Tesla describe it as a RESTful API, though? By the looks of things, the author has discovered it and decided to call it RESTful himself, even though it's just an HTTP API. A RESTful API is more than just using GET to access resources.
- mixedbit 14y agoAgree, there is a long way from HTTP API to REST API and this one is definitely missing key REST features.
- timdorr 14y agoTrue. It's not truely RESTful, just REST-ish. But if you wanted to wrap this in an HTTParty or RestClient library, that would still work.
- addlepate 14y agoGee, I never hear that every single time the word "RESTful" is uttered.
- sopooneo 14y agoI agree. This interface is not RESTful, and that's good, because it's not a good fit for REST. I may be wrong, but it seems REST is best suited for accessing and creating resources. And it seems you would have to do a lot of conceptual mashing to represent all this API needs to do as resources. I am happy to be corrected.
- prawks 14y agoFor more topics along these lines, look into Resource-oriented Architecture (ROA) [1]. Many REST tutorials and classes are often further labeled as Service-oriented, which is really untrue. This is also why many existing SOAs are unfit for a RESTful transformation. Truly RESTful API's deal with resources, not services/business processes. [1] http://en.wikipedia.org/wiki/Resource-oriented_architecture http://en.wikipedia.org/wiki/Resource-oriented_architecture
- bct 14y ago
- xetorthio 14y agoIt is weird that you connect to the API through http and send user and password in plain text.
- timdorr 14y agoIt's https, actually.
- mixedbit 14y agoHope this is secured against cross car request forgery.
- driverdan 14y agoMy first thought was "Holy Shit! Cookie only authentication and you can unlock the doors, among other things!" It's absolutely vulnerable to XSRF with cookie only authentication. This is a huge security issue.
- deleted 14y ago[deleted]
- pjmlp 14y agoLovely /vehicles/{id}/command/door_unlock
- calinet6 14y agoExactly what I was thinking... one vulnerability in their stack and every car is pwned.
- toomuchtodo 14y agoFingerprint the requestor by IP; what's that? You're making more than 1 request per second to more than more vehicle ID and you're not a trusted partner? BAN LIST
- emidln 14y agoMeh, you've had these for years. I'd put it at even money that some RF protocol stacks on recent vehicles are vulnerable to exploitation and connected to one of the CAN buses on the vehicle so you can pivot to a more critical system. Hurray for drive by exploits (literally). I'm honestly surprised that criminal organizations haven't paid/coerced engineers working how to steal certain cars using a remote control, because I'm pretty certain that with some effort, it's possible.
- Achshar 14y agoThis is when software bugs start affecting physical (costly) things.
- raphaelj 14y agohttp://www.youtube.com/watch?feature=player_detailpage&v=meY1R43fJIQ#t=35s http://www.youtube.com/watch?feature=player_detailpage&v...
- stereo 14y agoThis would make an interesting music instrument. I hope someone writes something that makes it MIDI-compatible.
- MatthewPhillips 14y agoComing soon to the HN front page: RoadRage.js
- nolok 14y agoIt has an active 3G connection at all times and can be queried for its GPS position ? Damn, future is both exciting (tech wise) and scary (privacy wise). Now that I think about it I'm sure it's not the only car with this, but I didn't realize before
- mlnowak 14y agoThis is really actively used in fleet management domain today. Mostly for utilization analytics, fuel usage, idling detection, driver behavior etc. It is amazing how many efficiencies can be found in the data...
- RandallBrown 14y agoI believe this tracking has to be turned on by the user.
- driverdan 14y agoHello XSRF! Cookie only authentication? Seriously?
- dwiamo 14y agoNot a new thing - Tesla not the first automotive to do this.
- spoonyg 14y agoI use this every night from a python script to force the charge to start after the electricity becomes cheaper. So far it is fast and reliable.
- coldskull 14y agowow....they are using GETs for everything ! :)
- onethumb 14y agoNeat! Couple of nits, though, if anyone from Tesla is reading: - Wish it used OAuth or some other revocable token mechanism. What if I lose my device? Sell the car? Get a divorce? etc.. - GET for things that change state? Looks like these are all idempotent, so they should be PUT. - Versioning might be nice. :) Still, progress! Clean API over HTTP that returns easy-to-parse JSON for a car = win.
- miket 14y agoThis is great! Can't wait until they add steering, gas, and brake to the API.