Dear developer and smart home enthusiasts,
today, we want to contact you to talk with you about the recent activities that are taking place concerning the interface of the heating systems, also known as the Viessmann API. As most of you might have already received our Email in which we informed you about the upcoming changes concerning the use of the API, we would like to open this thread to continue the discussion openly and transparent with you and pick up on the discussions in this thread. Here is again a brief summary of the main points from our message:
> As Viessmann, it’s in our responsibility to provide our users with reliant and safe products, including features and services around those products
> We are impressed to see your interest in connecting and interacting with your heating system and that you found a solution for your specific use case without a description or support from our side
> However, it challenges us to check and channel the method and frequency of requests to our IoT Services in order to keep those stable and available for all our users
> What is even more important is that for these solutions, we as Viessmann currently cannot guarantee a safe and reliant operation of your heating system
This has the following steps that we have to take:
> In order to keep operation through our API safe and still give you the chance to interact with your system, we limit the use for all applications by setting a threshold for the requests. The limit is set for both a larger (e.g. daily) and a smaller (<15 mins) time scale. Reaching the limit will prevent you to execute any further requests with your account in the specific time frame. So please make sure to adapt the frequency of the requests of your current solution to avoid reaching the limitation.
> We are heavily working on providing a solution for all users that is 1) approved & safe to use, 2) properly explained and 3) gives you the functions and information you need for your specific use case. At the same time, this will also be moment when the solution is in place where we cannot allow any other ways of accessing our API. To make things clear: Your already built and currently used functions will still be able to use, it’s only that you will need a new API client provided through the Portal that can be self-managed by the user himself.
We also received a lot of questions via Mail and also in this forum, which we are going to answer for everyone individually. We also saw that the most common question among the responses was the demand for a local API. This is a reasonable request and we appreciate and take the demand very seriously. However, we will not able to provide you a solution for this in the near future. This feature (as all other features and requests by users) are permanently discussed and evaluated and brought together with all other strategic decisions that Viessmann is taking.
I again would like to encourage everyone to participate in the development and make sure to sign in here to get an early access to the Developer Portal. Also, we are hoping to have a constructive discussion here in this thread. We are really looking forward to work jointly together with you on ideas and co-create future solutions!
P.S.
As stated in the previous thread and in certain Emails we received, we are aware that some users might expect a communication in german from us, as Viessmann is of course a company with German heritage. However, since we are providing climate solutions all over the world and especially programming / APIs is natively described in english, there is no other option than communicating in english first. This has already been greatly explained by @thetrueavatar in the previous thread.
All the best!
Michael Hanna
Viessmann Developer Portal
EDIT:
In order to support you more on adjusting your current solutions according to the current limitation, here is how the threshold works:
We have a rate limit with sliding window. Whenever the first request arrives, we open a time window and count all request in that window. If the number of requests reach the limitation, we block all incoming user requests until the time window ends. Then, with the next user request, a new time window opens.
Currently, we have the following limits active:
120 calls for a time window of 10 minutes
1450 calls for a time window of 24 hours
Please take note that we are taking the right to adjust the limits if seen necessary. Information about adjustment of the threshold will be given with a reasonable amount of time in advance for all affected user.
EDIT2:
For all who experienced a ban after the limitation time frame with a few number of API requests: Our team fixed an issue with the limitation, which is taking effect since today and should solve this problem. We are still analyzing the behavior, but for now it looks ok.
Ok I get back my account for an 1 hour... I have disabled the cron and did at most 10 call but I'm banned again till tomorow 17h24pm.....
Even with my cron enabled it won't be possible to reach 1450 request in 1h30m...
So either someone else is using my account, either your count doesn't reset to 0 on the due time....
It's very frustrating while I'm trying to refactor the code of the my api client to reduce load and prevent some of your user to be blocked....
Hi
Looks like the 24h limit is implemented as a 'moving' window (or however it is called)
Probably still suffering from the high load of the initial 20h or so
Michele
@thetrueavatar You might be right, but I am not sure about that. They are using Azure MQTT IoT services for communication of Vitoconnect with their server. But the ips of the app API seem to belong to T-Systems (Telekom), so it might be that those are not routed to Azure at all. I was wrong about that. Checked the wrong ip. The API ip is indeed belonging to Azure, so your findings seem to be right.
@MichaelHanna my account was banned yesterday (17.3.2020) at about 17:15. I then disabled all scripts and could open the ViCare app tonight at about 18:00 one time. Then I tried re-enabling the connection through ioBroker, but it failed with error 429 directly after login when calling GET https://api.viessmann-platform.io/general-management/installations … So this was only one or two requests (besides the ViCare App) that triggered the error 429 again. I disabled the ioBroker directly after that, but until now (21:12) the ViCare app still is not able to connect. So the ban is still in place.
What about the suggestion to just enable MQTT to a second (local) server? This should be really easy to implement. Especially compared to a local api etc.
Well Before 11 AM 17 marchi I was doing every 5 minutes this list of call:
- active mode
- active program
- outside temperature
- heating burner status
- HotWaterStorageTemperature
- Boiler temperature
- normal program temperature
- reduced program temperature
- slope & shift
- DHW schedule
- Heating scheduleA
- Room temperature
Every call first do an authentication, then do a call to general-management/installations andoperational-data/installations/gateways/gatewayId /devices/device_id/features.
I would say 12 authentication and 24 call to the API every 5 minutes this lead me to be ban today.
HOWEVER, I have disable all of those call on 11 AM this morning(17 march). I got my access back at 17h20 and did some manual call to test my refactoring.
I have done during 30 mintes 2-3 calls to get curve information 10 call to "general-management/installations" and "operational-data/installations/gateways/gatewayId /devices/device_id/features". That's all. And I have being ban again.
The lock is weird. The lock today was release on Tuesday, March 17, 2020 5:20:10.106 PM
The new one was set on Wednesday, March 18, 2020 5:23:42.988 PM
So it took me less than 4 minutes to be blocked !!! Moreover, I didn't test it in this timeframe...
Here is a received message right now:
{"viErrorId":"req-4485c64081604168a4ae9220d192fe8e","statusCode":429,"errorType":"RATE_LIMIT_EXCEEDED","message":"API calls rate limit has been exceeded. Please wait until your limit will renew.","extendedPayload":{"name":"ViCare day limit","requestCountLimit":1450,"clientId":"79742319xxxxxxxxx2a8","userId":"d61aexxxxxxxxxx-xxxx-7a492bb94efb","limitReset":1584548622988}}
Hello,
have Vicare accounts been (perma-)banned as result of these limits ?
Users have disabled their Home Assistant Vicare-integration, but the Android app continues to throw an error (not connected to server).
Can this also be addressed please?
@thetrueavatar:
Thanks for your explanation. I am observing the same (no wonder!). Additionally of course the ViCare App is banned also, do the calls by this app also count?
I deactivated all my API calls, in order to see if ViCare is coming back.