Insurance / Safety Score

[LelandSindt]

Anyone looking at the insurance endpoints?

https://github.com/timdorr/tesla-api/blob/master/docs/miscellaneous/endpoints.md

  "INSURANCE_GET_ELIGIBLE_FOR_TELEMATICS": {
    "TYPE": "GET",
    "URI": "bff/v2/mobile-app/insurance/eligible-for-telematics",
    "AUTH": true
  },
  "INSURANCE_GET_DAILY_BREAKDOWN": {
    "TYPE": "GET",
    "URI": "bff/v2/mobile-app/insurance/daily-breakdown",
    "AUTH": true
  },
  "INSURANCE_GET_TRIPS": {
    "TYPE": "GET",
    "URI": "bff/v2/mobile-app/insurance/trips",
    "AUTH": true
  }

I started to look at them a bit this morning but didn't get to far..

$ curl -i -H "Authorization: Bearer [my-token]" https://owner-api.teslamotors.com/bff/v2/mobile-app/insurance/eligible-for-telematics; echo
HTTP/2 422 
x-xss-protection: 1; mode=block
x-txid: 43793244880018f208c73ec9fb81d712
content-type: application/json; charset=utf-8
x-request-id: b6c62259-d20f-48d3-9e51-c9057502c524
x-envoy-upstream-service-time: 17
x-envoy-upstream-cluster: owner-api
x-frame-options: DENY
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, private, s-max-age=0
date: Sun, 26 Sep 2021 15:38:24 GMT
server: envoy

{"response":null,"error":"param is missing or the value is empty: vehicle_id","error_description":""}

adding vehicle_id returns a 500... and much less helpful error...

$ curl -i -H "Authorization: Bearer [my-token]" https://owner-api.teslamotors.com/bff/v2/mobile-app/insurance/eligible-for-telematics?vehicle_id=[my-vehicle_id]; echo
HTTP/2 500 
x-xss-protection: 1; mode=block
x-error-code: oxp-500
x-txid: d2320c07c8973cb3f7c79bde8b92ee21
content-type: application/json; charset=utf-8
x-request-id: 75d52f35-151b-424c-84a5-d89b3d7e98b5
x-envoy-upstream-service-time: 65
x-envoy-upstream-cluster: owner-api
x-frame-options: DENY
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, private, s-max-age=0
date: Sun, 26 Sep 2021 15:40:26 GMT
server: envoy

{"code":500,"data":null,"message":"Oops! Something went wrong. d2320c07c8973cb3f7c79bde8b92ee21","success":false}

[corsair]

These particular endpoints are not currently utilized by the mobile app and thus won't function until Tesla activates the full Tesla Insurance UI and functionality in the app. The Safety Score UI and tab utilize a different endpoint and not part of the Owner API domain.

[LelandSindt]

@corsair Thank you for the response...

For what its worth, I did some digging and was surprised to see that the android app was not hitting owner-api.teslamotors.com but instead akamai-apigateway-vfx.tesla.com for the Insurance/Safety Score information. But with your feedback that makes more sense.

Do you expect that the Insurance/Safety Score information will eventually be available via the Owner API domain? (... from experience?)

[corsair]

There are some new endpoints introduced with the 4.1.0 update, including that domain you shared above in addition to some utilizing the ownership.tesla.com domain. Another notable change is that ALL endpoints, including the Owner's API now utilize the SSO access token, instead of requiring the generating of Owner's API tokens (qts-).

While the Owners API endpoint still accepts the Owner's API tokens (OAT), it is likely that Tesla will begin to deprecate these sometime in the near future, since the mobile app now utilizes SSO access tokens instead of OATs. I would suggest beginning to transition any apps/third-party services that currently utilize OATs to use just the SSO access tokens to avoid any broken functionality.

Still navigating through all of the new endpoints and will try to share/document them soon (likely via an issue in this repository) in the following weeks. 👍

[LelandSindt]

@corsair, Good deal, again thank you for the insights.

@adriankumpf does this SSO vs OAT information change the requirements in the cat-and-mouse auth/token game?

[adriankumpf]

@LelandSindt This has nothing to do with it. The problem is that an obfuscated JavaScript has to be executed in a browser-based environment so that the recaptcha is not displayed on the login page.

[tdorssers]

Does anybody know some more details about the safety score endpoints, working example: tdorssers/TeslaPy#37