Reverse-engineering the Enel X Way API

enel-x-way-api.md

Reverse-engineering the Enel X Way API

These API endpoints were extracted from decompiling the Enel X Way Android app.

Authentication

https://emobility.enelx.com/api/authentication/v2/oauth/refreshToken

Status

https://emobility.enelx.com/api/emobility/v2/status

Charging

Home

https://emobility.enelx.com/api/emobility/v2/charging/process/start
https://emobility.enelx.com/api/emobility/v2/charging/process/{sessionId}/stop
https://emobility.enelx.com/api/emobility/v2/charging/process/{sessionId}/status

Public

https://emobility.enelx.com/api/emobility/v2/charging/station/{stationId}
https://emobility.enelx.com/api/emobility/v2/charging/station/carplay

Reservation

https://emobility.enelx.com/api/emobility/v2/reservation
https://emobility.enelx.com/api/emobility/v2/reservation/{reservationId}

User

https://emobility.enelx.com/api/user/v2/profile/

Utility

https://emobility.enelx.com/api/utils/v1/functionality/
https://emobility.enelx.com/api/utils/v1/labels
https://emobility.enelx.com/api/utils/v1/callback/payment-ok
https://emobility-qa.enelx.com/api/utils/v1/callback/payment-ok

Just checking if you have made further progress on this. I tried to use Postman to look at the calls being sent to/from the server and it doesn't seem to be using a Rest API protocol. I do see an occasional post to this URL: https://dynatrace-saas.enel.com/mbeacon/, but believe this is more a synch function than any commands. For instance, when I log into the app on the iphone, I see no authentication steps done via a rest API.

Unfortunately no. Modern versions of Android make it incredibly hard and cumbersome to sniff traffic, and I didn't move forward with understanding the disassembled logic either. The more promising route is probably the Juicepass proxy that intercepts requests.

How can I log in to get the token?

We don't know yet, sorry.

How can I log in to get the token?

Did you try https://emobility.enelx.com/api/authentication/v2/oauth/token ?
You may need to use Postman in case it's a POST instead of a GET

If you manage to get the token then you should be able to hit the endpoints successfully.

following along, I started doing the same

Not sure if the app route is the future, given their recent statement. I have higher hopes in the Juice Rescue initiative. I couldn't get it to work on my purchased-in-Spain European Juicebox, though…