You're not calling those methods on the car. You're calling them on https://portal.vn.teslamotors.com/ https://portal.vn.teslamotors.com/ which has no particula

You're not calling those methods on the car. You're calling them on https://portal.vn.teslamotors.com/ https://portal.vn.teslamotors.com/ which has no particular limitations. Likely the web service communicates with the car over their VPN using an internal protocol (though it could well be similar, since there are web servers running in the car.) So there's no particular excuse based on "embedded systems". I do agree it should use POST, but it's not quite as bad as it looks. Besides it being an authenticated API (so bots aren't a real problem), the calls are almost all set up to create a certain state, and repeating that call once the car is in that state (or working on it, I presume) seems quite safe. 'auto_conditioning_start' and 'auto_conditioning_stop' are okay to repeat; 'auto_conditioning_toggle' not so much. Though one does kinda wonder about the horn honk one.