Enphase Envoy-S “Data Scraping”.

If you are interested in other Enphase information the following other pages may also be of interest:
Reverse Engineering the Enphase Installer Toolkit
Enphase Envoy-S Open Ports!

I’ve recently had to interface with an EnPhase Envoy Solar PV system. The annoying thing is the lack of documentation.

The API for the “cloud service” exists and is well documented but the API for the local device itself doesn’t seem to exist.

There is one tiny one page document that seems to suggest you can get some data from the device. The information gleaned from their example API ” http://device.ip.address.here/api/v1/production ” is poor.

 "wattHoursToday": 6641,
 "wattHoursSevenDays": 6641,
 "wattHoursLifetime": 6669,
 "wattsNow": 90

First.. it gives far LESS information than you can just retrieve from the main web page for the device on the LAN. Secondly the wattsNow field doesn’t seem to match the information displayed on the main page of the device. The wattsHoursSevenDays is also slightly off. Third.. it doesn’t even update regularly. You can’t have a system that detects dips in production due to cloud cover etc.

However. I did find some other sensible sources for information – and information that updates at an even more regular rate than the devices main website!

When you visit the site on the device running firmware D4.2.27 it makes the following requests:
This URL contains a lot of references to other json files that I need to research. See further down in this post for the other URLs exposed.
This json file contains the Database size / utilisation, date and time on the device, connection status and settings and update status.
Contains most useful information.. Production and (if fitted) consumption data!

Also contains some very useful information. Detailed status about the state of each micro-inverter. So far I’ve seen the following states:

– “envoy.global.ok”
– “envoy.cond_flags.pcu_ctrl.commandedreset”
– “envoy.cond_flags.pcu_ctrl.dc-pwr-low”
– “envoy.cond_flags.obs_strs.discovering”
– “envoy.cond_flags.obs_strs.failure”
The full conversion table on what these status messages mean in english is at the end of this article.

The full output of the page is as follows:


All of this means you can make your own system that (in my case) refreshes generation and consumption status up-to-the-second!

A couple of notes: The Consumption metering / data seems to give strange low or even minus values if you fetch the json file more than roughly once per second. (Possibly because it works on a counter and the math goes wrong?)
During nighttime the Production metering goes into a minus value, for example -7 Watts. This is in fact the correct reading. The Envoy-S javascript filters out minus values and ensures a 0 is displayed. Cheeky!
The panel count on the main production.json file is the count of associated panels and not the currently generating panels. I’ve used the inventory.json file to count the number of panels “producing”, I refresh this information every 3 minutes instead of every second.

solar status

solar panel status

My next steps are to investigate the JavaScript and see what other pages are accessible. I also need to see if I can reverse engineer, find out or ask the installer for the “Installer Login” password.

I also wish there was public documentation. No google searches for the status strings or other data I’ve found in the JSON files have returned any results to do with Enphase / SolarPV.

The backbone/application.js file exposes the following sub-files on the devices web server.
– /admin/lib/admin_dcc_display.json
– /ivp/tpm/capability
– /datatab/event_dt.rb?start=0&length=153
– /info.xml
– /ivp/meters
– /installer/pcu_comm_check
– /api/v1/production/inverters
– /prov
– /ivp/peb/newscan
– /installer/profiles/index.json
– /installer/profiles/details.json
– /installer/profiles/inverters_status.json
– /installer/profiles/set_profile.json
– /admin/lib/admin_pmu_display.json
– /ivp/peb/reportsettings
– /ivp/tpm/select
– /ivp/tpm/tpmstatus
– /ivp/tpm/parameters
– /admin/lib/dba.json
– /admin/lib/security_display.json
– /admin/lib/date_time_display.json?tzlist=1&locale=en
– /admin/lib/network_display.json
– /api/v1/production/inverters
– /admin/lib/wireless_display.json?site_info=0

Full status messages system strings to plain english:

        cond_flags: {
            acb_ctrl: {
                bmuhardwareerror: "BMU Hardware Error",
                bmuimageerror: "BMU Image Error",
                bmumaxcurrentwarning: "BMU Max Current Warning",
                bmusenseerror: "BMU Sense Error",
                cellmaxtemperror: "Cell Max Temperature Error",
                cellmaxtempwarning: "Cell Max Temperature Warning",
                cellmaxvoltageerror: "Cell Max Voltage Error",
                cellmaxvoltagewarning: "Cell Max Voltage Warning",
                cellmintemperror: "Cell Min Temperature Error",
                cellmintempwarning: "Cell Min Temperature Warning",
                cellminvoltageerror: "Cell Min Voltage Error",
                cellminvoltagewarning: "Cell Min Voltage Warning",
                cibcanerror: "CIB CAN Error",
                cibimageerror: "CIB Image Error",
                cibspierror: "CIB SPI Error"
            obs_strs: {
                discovering: "Discovering",
                failure: "Failure to report",
                flasherror: "Flash Error",
                notmonitored: "Not Monitored",
                ok: "Normal",
                plmerror: "PLM Error",
                secmodeenterfailure: "Secure mode enter failure",
                secmodeexitfailure: "Secure mode exit failure",
                sleeping: "Sleeping"
            pcu_chan: {
                acMonitorError: "AC Monitor Error",
                acfrequencyhigh: "AC Frequency High",
                acfrequencylow: "AC Frequency Low",
                acfrequencyoor: "AC Frequency Out Of Range",
                acvoltage_avg_hi: "AC Voltage Average High",
                acvoltagehigh: "AC Voltage High",
                acvoltagelow: "AC Voltage Low",
                acvoltageoor: "AC Voltage Out Of Range",
                acvoltageoosp1: "AC Voltage Out Of Range - Phase 1",
                acvoltageoosp2: "AC Voltage Out Of Range - Phase 2",
                acvoltageoosp3: "AC Voltage Out Of Range - Phase 3",
                agfpowerlimiting: "AGF Power Limiting",
                dcresistancelow: "DC Resistance Low",
                dcresistancelowpoweroff: "DC Resistance Low - Power Off",
                dcvoltagetoohigh: "DC Voltage Too High",
                dcvoltagetoolow: "DC Voltage Too Low",
                dfdt: "AC Frequency Changing too Fast",
                gfitripped: "GFI Tripped",
                gridgone: "Grid Gone",
                gridinstability: "Grid Instability",
                gridoffsethi: "Grid Offset Hi",
                gridoffsetlow: "Grid Offset Low",
                hardwareError: "Hardware Error",
                hardwareWarning: "Hardware Warning",
                highskiprate: "High Skip Rate",
                invalidinterval: "Invalid Interval",
                pwrgenoffbycmd: "Power generation off by command",
                skippedcycles: "Skipped Cycles",
                vreferror: "Voltage Ref Error"
            pcu_ctrl: {
                alertactive: "Alert Active",
                altpwrgenmode: "Alternate Power Generation Mode",
                altvfsettings: "Alternate Voltage and Frequency Settings",
                badflashimage: "Bad Flash Image",
                bricked: "No Grid Profile",
                commandedreset: "Commanded Reset",
                criticaltemperature: "Critical Temperature",
                "dc-pwr-low": "DC Power Too Low",
                iuplinkproblem: "IUP Link Problem",
                manutestmode: "In Manu Test Mode",
                nsync: "Grid Perturbation Unsynchronized",
                overtemperature: "Over Temperature",
                poweronreset: "Power On Reset",
                pwrgenoffbycmd: "Power generation off by command",
                runningonac: "Running on AC",
                tpmtest: "Transient Grid Profile",
                unexpectedreset: "Unexpected Reset",
                watchdogreset: "Watchdog Reset"
            rgm_chan: {
                check_meter: "Meter Error",
                power_quality: "Poor Power Quality"

Some more info about errors can be found on page 45 of the manual.
CommandedReset Recommended Action: No action is required; it will automatically resume normal operation momentarily. Description: The microinverter was reset, either following a successful software download or by user command.

DcPowerTooLow Recommended Action: This condition should correct itself. No action is required. Description: This condition may occur at sunrise or sunset, while the modules are covered with snow, or during extreme weather. This event indicates that sunlight levels are too low for effective production. Once sunlight levels increase, the microinverter resumes power production and this event message will clear.

DcVoltageTooLow Recommended Action: This is usually a normal condition during hours of low light and at dawn and dusk. No action is required. Description: The microinverter reports that DC input voltage from the PV module is too low. If this condition does not clear during hours of full day

PowerOnReset Description: The microinverter has powered on after having DC disconnected.

This entry was posted in Uncategorized. Bookmark the permalink.

65 Responses to Enphase Envoy-S “Data Scraping”.

  1. Pingback: Enphase Envoy-S Open Ports! | thecomputerperson

  2. RRM says:

    Bought the envoy-s 3 weeks ago and having the same difficulties in reading the local data.
    Found several scripts for running man-in-the-middle option or scripts for OpenHAB, but haven’t found the information you wrote.
    Unfortunately I have not that much information in the production.json, as you demonstrate.
    I bookmark this link and follow your progress.

  3. Thank you for commenting. What firmware version is your Envoy-s running ?
    Does it show that you have micro-inverters connected and “producing” on the envoy-s web interface?

  4. RRM says:

    @license Backbone-Envoy 4.2.43 (2016-05-20)

  5. RRM says:

    Although the Enphase site clearly demonstrates the exact number of producing inverters, the only output I get from production.json is:

  6. Is that all you see in the production.json? In my case there is a “type”:”eim”, section and also a “consumption” section.
    You should also see if /inventory.json contains anything interesting too.

    I’ve not yet managed to work out how to get individual inverter generation statistics.

    This evening my Envoy-S seems to have crashed or hung! This will be interesting to try and work out how to solve. It is responding to pings but the web interface is not returning any data.

    Update: In the end I just had to turn off the power to the Envoy-S and turn it back on again.

    Do you have an Envoy or an Envoy-S? The one I have is running firmware “D4.2.27 (b13066)” with a “Software Build Date” of “Jun 03, 2016 1:17 AM” which is strange. Your comment seems to show you have a _newer_ firmware but with a build date after the build date of my older firmware which doesn’t make much sense.
    Also the request to the javascript file that my firmware makes references 04.02.43.. even more weird.

  7. RRM says:

    It’s an Envoy-S (EU version). The inventory page contains output which is more or less identical. Unfortunately the production.json not.

  8. Not sure what to suggest :(

  9. Paul says:

    Thanks for the head start.

    I have > D4.4.x

    when prompted for username:password are envoy:nnnnnn where nnnnnn=last 6 digits of serial number

    This works for wifi and diagnostics from home but not other screens :(


    /production.json?details=2 etc (might be interval records?)

    to do

    The installer toolkit can see all inverter details without a password – but how? Time to sniff some traffic.

  10. Thanks for the info. I’ve yet to try the installer toolkit and prod the buttons on the Envoy. Will it work while the Envoy is on the normal network? (My one is hard wired / ethernet).

  11. Paul says:

    Yes and shows live inverter level data. It can connect to the envoy wirelrss ap but also works if device is on the same subnet. The app queries the presence of the envoy and it responds with its serial number which appears in the app. Touch this and your in.

    You can see this arp traffic using wireshark but not http from app ??? May be limitation of windows on promiscuous mode can see http access from browser np..

  12. I will give it a go and post an update. It will be at least a few weeks before I get a chance though. Too many things to do and not enough time.

  13. Paul says:

    also try


    Authentication of installer app process

    app uses api key (based on info? eg S/N) and pings. This was different to the web API key!
    there is some traffic back and forth inc some binary
    /api/collected?apikey= XXXXXXXXXXX&currentTime=xxxxxxx

    /prov returns unauthorised
    /prov again gets a response. It contains authorisation below

    GET /prov HTTP/1.1
    Accept: application/json
    Authorization: Digest username=”installer”, realm=”enphaseenergy.com”, nonce=”xxxxxxxxxxxxxxxx”, uri=”http://192.168.0.x/prov”, response=”xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”, qop=auth, nc=00000001, cnonce=”xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”
    Host: 192.168.0.x
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: okhttp/2.7.

    hmmmmm……. digest access auth

  14. The information you are seeking about the energy each inverter is generating appears to be returned at this URL:


    It requires authentication. In my case I was able to replay an authentication request that I had sniffed 13 hours earlier! So if you can sniff a successful authentication header from the installer toolkit request _to that specific page_ you may just be able to replay the authentication line from the header for eternity!

            "serialNumber": "REDACTED1",
            "lastReportDate": 1472215582,
            "lastReportWatts": 221,
            "maxReportWatts": 244
        }, {
            "serialNumber": "REDACTED2",
            "lastReportDate": 1472215588,
            "lastReportWatts": 226,
            "maxReportWatts ": 248

    While playing about I did manage to get /home.json to spit out:

        "alerts": [{
            "msg_key": "lwui.home.warnings.cross_domain_traffic"


  15. RRM says:

    Unfortunately the amazon link of Paul isn’t working at the moment.
    I also tried to get access through the installer toolkit, but with the lack of passwords, it wasn’t successful.

    /api/v1/production/inverters requires name and password. I get exact the same data of my 20 inverters by filling in envoy and the last 6 numbers of the serial number.

  16. I’ve fixed paul’s link – it was missing the https on the http:// bit.
    Installer toolkit just let me right on on my system without the need to authenticate. Yet if I visit the same URLs on the browser it requires authentication.
    As Paul noted, the app generates the authentication details somehow.
    If you can sniff the details it seems the final authentication http header can be reused for eternity. It seems the envoy doesn’t check for expiry of the nonce.

    Sadly whatever details are generated are specific to your unit so I can’t share my http request with you and have you authenticate against your Envoy with it :(

  17. Paul says:

    Ypu shouldnt need user .. pass with the installer toolkit.

    It finds the envoy on the local lan or you can use the envoy ap lan.

    The s/n will appear when its found. Just tap on this.

  18. The Installer Toolkit application is a Xamarin (Mono) .net cross platform app. This means, when extracted, you get a load of (as far as I’m aware) windows compatible .dll files.
    The authentication is likely handled by “assemblies\Enphase.InstallerToolkit.dll”.

    Next step – I’ve got to learn how to reverse engineer .net dll files :< This might be beyond my abilities.

  19. Pingback: Reverse Engineering the Enphase Installer Toolkit | thecomputerperson

  20. RRM says:

    Succeeded in getting access through the installer kit.
    Tried to sniff the procedure with wireshark, which produced some files with http 1.1 or application/json information in it.
    Tried to search for keys/passwords, but my lack of knowledge of wireshark makes it a slow process. I’ll keep on trying with your suggestions.

  21. Dave says:

    Anyone know how to pass the username/password to the envoy-s api via http post? I’m looking to grab the panel level info, and I can do so via:
    ( is the wifi IP of my envoy-s)

    But it needs a username of ‘envoy’ and password of the last 6 digits of the serial number, which it pops up and requests. I’ve tried:
    (where 123456 is the last 6 digits of my envoy-s)
    which returns:
    “status”: 404,
    “error”: “”,
    “info”: “Resource /api/v1/production/inverters&user=envoy&password=123456 not found”,
    “moreInfo”: “”

    I’ve also tried the same thing but instead of & I used ?, and it popped up with the password prompt as if I wasn’t using them.

    Anyone figured this one out yet?

  22. What code are you using to scrape the data? Normally you just pass it extra parameters such as..


    (Very rough example, not working code!).

  23. Dave says:

    I was using a post–just pasting into the web page.
    I believe that using a format similar to an ftp site works. For instance:

    I need to test it on a separate computer.

    Once I have that working, I’ll figure out what language I want to learn to do this…right now I know perl, but I think I should probably learn python.

    Thanks for the reply…good to know there is a way to do it, and that I’m not barking up a dead tree!

  24. I’d approach it the other way around. Mash out the code and get it to authenticate and dump the resulting page.

    I’ve not got any experience in Perl but as far as I can see LWP takes authentication options:

     use LWP 5.64;
      my $browser = LWP::UserAgent->new;
        'usernamehere' => 'passwordhere'
    my $response = $browser->get($url);

    Perl looks pretty horrible from the code I’ve just seen, I expect Python is a far better bet :)

  25. wharwood says:

    I’ve been working to programmatically authenticate the inverter production page via Matlab. The built in authentication options don’t work and the method suggested above of using http://user:pass@xxx doesn’t work either.

  26. Do you have an Envoy or Envoy-S? My Envoy-S doesn’t need authentication for /inventory.json or /production.json so I can’t test against my own system and help you with code :(

  27. wharwood says:

    I have an Envoy-S. I too don’t need authentication for /production but the real data I want is in /production/inverters. That is password protected.

  28. Ah yes, that one is password protected but I’ve not yet figured out how to calculate the password from the envoy serial number. The older Envoy firmware was “installer” and the last 6 digits of the serial number (as far as I remember) but the newer firmware or Envoy-S seems to have a dynamically generated password.
    For more information on my password generation probing see:

  29. wharwood says:

    I must have an older unit then because user: envoy pass: XXXXXX (last 6 of serial) works for me.

  30. Doesn’t work for me :( I am on Software Version D4.2.27 (b13066)

  31. Dave says:

    I was able to get to this page by using the ‘envoy’ username and last 6 digits of the serial number. Try:
    (where you substitute the last 6 of your serial and your IP number)

    The only odd thing is that it pops up with a prompt that you have to click yes to, not sure how that’ll work out programatically.

    I haven’t had time to look into this, since I posted last.

  32. That one works for me with the envoy/XXXXXX details!

        "serialNumber": "REMOVED",
        "lastReportDate": 1475688141,
        "lastReportWatts": 0,
        "maxReportWatts": 259
  33. wharwood says:

    Matlab returns 401 on Dave’s link for me. Glad you that login info worked for you. I’m running software version R4.2.33 (b68db1)

  34. I can download Matlab and test here. I’ve never used it before – what are the lines of code you have that make the request ?

  35. wharwood says:

    It all revolves around the built in function “webread”. Documentation is here: https://www.mathworks.com/help/matlab/ref/webread.html Truthfully, Matlab is probably not the best language for this. It’s just the one they taught me in school. It’s also expensive.

  36. Dave says:

    My system has build D4.2.27 (b13066), for reference

  37. wharwood says:

    It interesting that we have what appears to be very different firmware builds. I have the Envoy-S Metered (ENV-S-AM1-120). I would guess you both do not have the metered version.

  38. I have a consumption and production clamp meter that came with the Envoy-S and the data read out shows on the Envoy page.

  39. It looks like matlab is just sending “Basic” authentication in a single request and not triggering a Digest authentication (First a non-authenticated request needs to be made in which the envoy provides a salt / nonce which matlab [or other software] then hashes the authentication details with to produce a unique authentication string before making the second authenticated request with this string).

    The following might help but I can’t actually see any code in that example about authentication even though it claims it tackles Digest auth.

    Wireshark is a great tool – Install it and use the filter “host” where is the IP of your envoy. Make a request / run your matlab script and you can then right click on a request and go to Follow –> TCP Stream to see if matlab sent a Basic or Digest authentication line.

  40. wharwood says:

    Just had a breakthrough. First, I took my own advice and got away from Matlab. I grabbed Visual Studio and started writing a console app in C#. The following code grabs the json file:

    var envoy = new WebClient { Credentials = new NetworkCredential(user, pw) };
    var response = envoy.DownloadString(url);

  41. jam says:

    It was only a matter of time before someone blogged about this stuff! I currently have OpenHAB polling my envoy-s production.json and logging production and consumption data, and also activating heating etc based on available power! :) The APIs they provide are USELESS….!

    I’ve also had my envoy-s metered crash twice now since I began polling it every few seconds or so. It required a hard reset. I have no evidence of course that it wouldn’t have crashed anyway, but it is annoying. Has anyone else noticed this, or has anyone had their envoy-s crash when not polling it? (you get an email from enlighten saying it is not reporting)

  42. I’ve certainly had it crash twice. Both times I thought it was due to my polling and it seemed to crash in an extended amount of time when I changed the polling to 2 seconds instead of 1 second etc.. but I don’t recall changing my polling code since and I’ve not had it crash (yet).
    If you poll the Envoy consumption data more than once per second you get totally screwed up values (minus values and the 7 day consumption total starts counting down!).

  43. Having said that – it crashed again today. Lots of other random services still respond but port 80 doesn’t ever load and the Envoy stops reporting to the cloud service. Boring. Wish I could reboot it remotely :<

  44. Jam: I’ve been testing. I thought maybe the crash was triggered by either.
    1) Requests being sent too quickly to the Envoy
    2) A hard-limit on the number of requests that the envoy can handle before it runs out of ram, temp filesystem space or something
    3) Race condition

    The number of requests I seemed to send before it crashed was around 604,800 however.. I’ve been soak testing it with a script that has been hammering the Envoy with over 100 requests per minute and I’ve reached well over 800,000 requests and it still hasn’t crashed.
    There goes my theory.

    Which files are you fetching every second? I was testing with /production.json
    I wish I had SSH or some other debug access to the device to either restart it remotely or, even better, figure out what is causing the lock up.

  45. jam says:

    Hi tcp, I really appreciate you hammering your system in the name of science!

    I am only fetching /production.json, once every 10 seconds on a little wifi display I built to have in the kitchen, and once every 30s on OpenHAB.

    I really think getting the installer password used by the installer app could possibly open up some options for getting further access to the box.

    I’m surprised they don’t have some kind of watchdog running on it to restart the service – it does stop it uploading to enlighten, and does stop logging data when it “crashes” so it’s kind of important….

  46. emdeex says:

    Some good info here, thanks. I’m using Splunk to fetch and display the data from my Envoy-S … there’s a short forum post here: https://answers.splunk.com/answers/390296/how-to-get-splunk-to-fetch-json-data-from-enphase.html#comment-451860

  47. Over the last week my Envoy updated itself from “Software Version D4.2.27 (b13066)” to “Software Version D4.4.89 (5e7c1d)”.
    I now find that the web interface (html and everything) takes many minutes to load up and the json files take a similar amount of time. Sometimes it takes 1.4 minutes, sometimes it takes 3.5 minutes, sometimes it takes 5 minutes to just return one of the json pages.

    The web interface now mentions batteries which I believe have recently been launched as an Enphase product in several countries.

    Anyone else had this firmware? Anyone else having page load delay problems?

  48. jam says:

    Same firmware has upgraded itself here – no delay problem. Also haven’t had any crashes for ages!

  49. Thanks.. I will monitor and see what is going on. Seems to be ok for a bit and then goes weird, possibly when I request inventory.json and production.json in very quick succession.

  50. Right. Not sure what has changed in the firmware / envoy back end but I’ve figured out what is going on. My code is quite aggressive: It checks for /production.json every second _but_ has a 1 second no response timeout. This is normally ok but..

    Also, every 3 minutes, I check for /inventory.json. It seems that sometimes /inventory.json is taking more than 1 second to respond with data (sometimes takes 600ms, sometimes takes up to 6 seconds) and is “blocking” so other requests get queued / delayed.

    My code then, at the next second, requests /production.json but as /inventory.json is still processing – it times out, then requests it again a second later.
    It seems that prior requests get queued still even though the TCP connection has been ended [RST, ACK (forcefully ended)] with the timeout. This ends up running away and the envoy appears to have locked up. If you stop _all_ requests and leave it for about 10-20 minutes, it recovers.

    You can reproduce this problem by loading up one of the .json files in your browser and constantly spamming the Refresh -> Stop -> Refresh -> Stop button (without waiting for the page to load each time). After about 20 or so goes at that you should see that your final request and ones shortly after take quite a long time to be responded to by the envoy.

    Something has changed with the way the envoy handles requests or how quickly it can respond to requests.. compounded by my aggressive code.
    I guess I now need to code, my side, failure detection and make my code “back off” so that the envoy can recover or fulfil all pending requests (double the delay until the next request, then double it again if it fails a second, third, fourth (etc.) time).

    I hope that the new firmware, with this quirk, does at least fix the total lockups that required a power cycle to recover from :D

  51. No crash or lockup since the firmware update!
    Yay. I no longer have to power cycle the envoy weekly.

  52. Ken Clifton says:

    Thanks for your work on this! I wish that I had an Envoy-S. My two older Envoys don’t have many of the items mentioned. In case you are interested, I created a Python script to archive the event log on the older Envoy version — it may work with your Envoy-S… Short link: https://goo.gl/kWHcBJ

  53. Cam says:

    I can get a fair bit of data following you instructions including panel production, but what program did you use to make your own system and refresh the data?

  54. I’m using asp classic and built in logic to cache the response for X seconds before making another request.
    This means I can have multiple displays or systems (automatic space heater that uses up spare energy instead of exporting) polling my ASP page multiple times per second! but my ASP only “bothers” the Envoy-S every 3 seconds and returns that cached result until it expires.
    See my previous comments (above) about how the Envoy really doesn’t cope well with lots of requests in quick succession.

    ASP Classic was my choice because I knew I could develop something rapidly. Anything else would also work fine, PHP, Perl, Python or even a simple bash script using wget and grep.

  55. Cam says:

    Thanks for the quick response. Any chance you would be able to share the script/programming you wrote for your own system which I could then adapt. I’m not great with writing my own. Also I would probably only request every 10 seconds so I don’t upset my envoy.
    Thanks again.

  56. Difficult to share without knowing what it is going to be used for. My code spits out javascript which probably won’t be suitable for whatever you want to use it for. And my code is ASP classic which requires an IIS / Windows server.

  57. Cam says:

    No worries. I’ll work on it from another angle.

  58. Dave says:

    Ken’s python script does not work with the current envoy-s firmware. It gets both an unauthorized error, and it looks like the envoy login doesn’t allow access to the event log, at least at that location, even with the envoy:last6ofsn login.

  59. Ken Clifton says:

    Thanks for checking that Dave. You can try downloading the event log directly to see if the location is correct — it is at — http://%5Benvoy ip address]//datatab/event_dt.rb

    I wish that I had an Envoy-S to test with. Does anyone know if the Envoy-S will work with the older M190, M215 and M250 series inverters?
    The fact that it exposes the production information makes it very attractive to me…

  60. Compatible Micro-inverters.. a convenient table is here:
    Looks like the M215 and M250, yes.. M190 isn’t even mentioned.

    On the Envoy-S you need to issue the event log request with start= and length= variables for it to return information. For example /datatab/event_dt.rb?start=0&length=153

    I’m still stuck on the reverse engineering of the password hashing function :( Shame.

    Off-topic: I can find at least 688 Envoys just “open on the internet”.. I do hope they’ve been designed securely! Otherwise another potential IoT disaster.

  61. Ken Clifton says:

    Yes, the whole IoT thing is a disaster waiting to happen. My two Envoy(s) are behind multiple firewalls.
    Since I don’t have the “S” model, I can’t do any testing. My Python script is fully commented so you can see where the request to the event_dt.rb has a whole bunch of parameters being passed. I do understand about the start and length on your “S” version.
    I wish you luck with the password hashing. It is a shame they don’t expose the data with a password known to the user.

  62. Ken Clifton says:

    BTW, to get the parameters I did the to get the network monitor in Firefox, then copied the exact request made by the Eventlog page on the Envoy. I noted in the script the parameters that I have changed with effect — some it seems to ignore.

  63. Ken Clifton says:

    The keys were stripped out: control and shift and q

  64. Matthew says:

    Guys if I want to pass my user id envoy and password – last six digits of the Envoy-s to read the individual inverter / panel data – does anyone know the format of how I need to pass these parameters? My code has issues passing these credentials.

    If I key the local device URL into Chrome and enter envoy and 012345 when it prompts for user id and password it accepts this and shows all the relevant details:

    “serialNumber”: “121440006251”,
    “lastReportDate”: 1484971459,
    “devType”: 1,
    “lastReportWatts”: 172,
    “maxReportWatts”: 255
    “serialNumber”: “121440009849”,
    “lastReportDate”: 1484971423,
    “devType”: 1,
    “lastReportWatts”: 220,
    “maxReportWatts”: 251


    My html file is executing the following JSON code

    $.getJSON(“http://envoy:012345@”, function(data) { …}

    BTW – is the code for the screen on the first page shareable? Love to see how youo did what you have!

    Many thanks,


  65. It looks like getJSON might be jquery? If so it seems that jQuery can’t do Digest authentication and will likely just be sending Basic authentication headers.

    This looks like an addon for jquery that might help:
    (I’m no expert in jquery so the above might be wrong or out of date).

    Ref – the code from the first screen shot.. it is in ASP Classic which pretty much nobody uses (or should be using) so probably not worth sharing.

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s