Tesla Model S JSON API

http://docs.timdorr.apiary.io/?cmd=honk-horn

by daenz • 12 years ago

80 84 12 years ago

docs.timdorr.apiary.io

noonespecial5• 12 years ago

Wait. GET's can unlock my doors and honk my horn and stuff? Don't let anything spider that page of links!

eknkc• 12 years ago

Works with a cookie though.

Still, I'm gonna bet that someone's gonna find a way to abuse this in a hillarious way.

noonespecial5• 12 years ago

I think its worse than that. This invites accidental hilarious fails much more.

waqf• 12 years ago

Right, since it has side effects this should be a POST action.

grinich• 12 years ago

or a PUT rather ;P

noonespecial5• 12 years ago

I'd humbly submit that PUT is the better choice. POST is to create the resource, PUT would be better to change its state. I don't want to make a new horn, just honk the one thats there. (PUT is also usually considered idempotent, honk as much as you want!)

  PUT /vehicles/{id}/horn

  {
  "command": "honk"
  }

notastartup• 12 years ago

imagine if this was stuck on loop. hopefully some rate limiting is already built in.

giancarlostoro• 12 years ago

Watch Dogs anyone?

matthuggins• 12 years ago

Pretty sure this be a POST request.

schoen• 12 years ago

How do these commands get invoked, and how do the commands get delivered to the individual cars? Is this something that people can invoke on the official Tesla web site after authenticating to it in some way, or is it something that people invoke on a web server running on their individual car?

bjt• 12 years ago

The URL includes the car's ID number, strongly implying that this is a centralized service running in a data center, not a server running on the car's computer.

zoomerang• 12 years ago

I can't wait for somebody to hack this and make every Tesla on the planet start honking at the same time. (Presuming there's a 3G hookup of some kind going on here)

nicklovescode• 12 years ago

Other discussion on this topic here: https://news.ycombinator.com/item?id=7961944

dlisboa6• 12 years ago

This is unofficial documentation of the Tesla Model S REST API

Very few concepts have been so hugely corrupted to mean exactly the opposite of what they mean as REST. This is probably the least REST API in existence.

gregory144• 12 years ago

I agree with you, but I have trouble understanding the right way to implement "commands" like this - I must be thinking about it in the wrong way. How would you design a "real" REST interface for a command like this? What's the advantage a "real" REST interface gives you in this case?

benregenspan2• 12 years ago

Exactly -- where does something that is designed for "state transfer" get you when the goal is to only temporarily modify a state/send a command that modifies internal state for X amount of time, not really "transfer" one at all? REST maps very nicely to CRUD operations, but not to this.

benregenspan2• 12 years ago

(That said, they should definitely use POST here!)

jholman4• 12 years ago

Right. REST is about Transfering the State's REpresentation. In this case, we want to transfer an event ("honk!"). You could argue that we want to transfer a state transition ("begin honking"), and let some other process (the car) handle the next transition ("cease honking") independently, but that's forced, and in any case it's not RESTful either.

As far as I can tell, REST is appropriate in very few cases.... although it IS appropriate for more cases than it might first appear.

chrisrogers• 12 years ago

You would use RPC.

andrewstuart22• 12 years ago

I don't know the whole state of the vehicle. I don't want to. So I'll use PATCH. I know I want the horn to be in a honking state and remain in that state for 1 second. The implementation is responsible for doing what it needs to do in order to get the resource into the state (or differential state in this case) I told it to take.

I'm not usually in favor of nested API design, but complex resources like cars make sense, so:

PATCH /vehicles/{id}/horn { "enabled": true, "timeRemaining": 1000 }

dlisboa6• 12 years ago

There are some ways, I'm just thinking off the top of my head for one here.

If the resources of the car were mapped and had states it could work fine with a full REST interface. You could change the state of the horn like you change the state of a switch. You'd change the horn to be "on", not call some "turn it on" procedure.

They have some indications of that. There's a URL that returns the state of the vehicle (driving and position). That's something that could be mapped as a first-class citizen and someone could mess with it with the semantics of the verbs.

Commands are a much more RPC area though, REST doesn't map perfectly. You can almost always make a command into something of a resource state change, it just isn't always simpler. REST wouldn't give them much in this case as it's hard to imagine they'd make use of any of REST advantages. Not that there wouldn't be any technically (being able to evolve APIs without breaking clients is a pretty big advantage, plus plenty of other things), but that for their business it doesn't matter (they control every client).

pornel• 12 years ago

Here's Roy Fielding's summary:

http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hyperte...

After reading this I cringe whenever I see any API claiming to be "REST(ful)".

chime• 12 years ago

A REST API must not define fixed resource names or hierarchies (an obvious coupling of client and server). Servers must have the freedom to control their own namespace. Instead, allow servers to instruct clients on how to construct appropriate URIs, such as is done in HTML forms and URI templates, by defining those instructions within media types and link relations. [Failure here implies that clients are assuming a resource structure due to out-of band information, such as a domain-specific standard, which is the data-oriented equivalent to RPC's functional coupling].

I don't even know how I'd write a client against a server that arbitrarily changes endpoint URIs. I honestly don't see a benefit of RESTful if REST requires complete decoupling of the server and client. REST isn't SOA. There is no discovery API for REST. If I don't get to hardcode /api/vehicle/, then how else can I write a functional client?

timdorr3• 12 years ago

(Project owner here)

My fault for calling it that. It's REST-ish, but not RESTful. Tesla never called it that (they don't even officially acknowledge the API), so it shouldn't be misconstrued as them not knowing what REST is. This is their internal API for the mobile apps, so they're free to design it however they like.

aroman• 12 years ago

How is it REST-ish, even?

coherentpony• 12 years ago

Very few concepts have been so hugely corrupted to mean exactly the opposite of what they mean as REST. This is probably the least REST API in existence.

This is the first time I've seen URL APIs not being referred to as RESTful. What makes it non-RESTful?

steveklabnik• 12 years ago

It's not according to both RESTs:

Fielding's REST says absolutely nothing about URLs or their structure.

Everyone else's REST (and, the HTTP spec) says that you shouldn't use GET to cause a side effect.

zak_mc_kracken• 12 years ago

Most people use REST as a synonym for "API you can call over HTTP".

I've never liked the dogmatic aspect of REST anyway, saying that API's should only ever be REST-ful is like saying that you should never call functions in your programs and only ever use getters and setters.

mschuster91• 12 years ago

If anyone ever manages to penetrate the central VPN server which Tesla uses for its cars, this will be total mayhem.

Also, which server are they using? That alone is an interesting fact, as it has to support tens of thousands of simultaneous connections...

greggman• 12 years ago

Nothing special about Tesla

Many of the other car manufacturers provide remote access to cars. See GM's OnStar, Ford's Sync Services, etc... One of those companies used to advertise on TV you calling them and having them unlock your car remotely and IIRC starting the engine.

userbinator• 12 years ago

The difference is that those services are optional and often opt-in, whereas with the Tesla it appears to be mandatory.

Personally, I'm not too fond of my car being accessible remotely unless it's me who has control over that access.

timdorr3• 12 years ago

The app server was Thin last I checked. It's a Ruby app, though probably not Rails (hopefully not, at least). The streaming stuff is a node.js server. I assume they have a load balancer in front of it all.

Keep in mind this isn't for the telematics, which are an entirely different system. This just gives you a view into some parts of that system. This is primarily used by the mobile apps, so the activity level is likely much lower than that.

nanavatiarpan• 12 years ago

shouldn't this be a POST ?

tshadwell• 12 years ago

It's good to know that cars can now be remotely controlled via CSRF attacks.

delinka• 12 years ago

How should one RESTify methods? If my 'state' is represented as objects, and I want to execute a method on one of those [remote/server-side] object, what's the RESTful way of calling that method? I don't even know what RPC over HTTP should look like, let alone whether mixing it with REST would even be acceptable.

marcosdumay2• 12 years ago

let alone whether mixing it with REST would even be acceptable

Why wouldn't it be acceptable? Can you think about any reason? Because I can't. (And you could reach some very nice API independence by carrying RPC metadata at the REST API.)

The only thing I see here that I think is wrong is that the API uses GET when it should use other verbs. But lots of people already pointed that.

haberman3• 12 years ago

While this is clearly not REST-ful, the fact that the comments here can spend so many words philosophizing over whether this ought to be PUT vs. POST vs. PATCH illustrates why REST is not my favorite technology.

It's like XML all over again. Should it be an attribute or a child node? Should the parameter go in the header, or in the body, or in the URL? Should it be part of the URL path, or a URL parameter? Should the error be indicated in the HTTP status code or just in the body? Did we get it right, or do we need to find a Roy Fielding quotation illustrating the principle we violated?

Normally this wouldn't bother me, since I generally have faith that the "free market", so-to-speak, will favor the best technologies in the long run. But HTTP and REST have an artificial boost in that they are the only way to get through many firewalls, so in essence everyone has to go along with REST whether they want to or not (or at least tunnel over it). And of course everything can be made to work with REST, so everyone eventually converges on it, even if it's not the best fit, and its dominance grows.

philwelch• 12 years ago

Sometimes you just need to call a procedure, remotely.

andrewchoi• 12 years ago

Isn't that what SOAP is for?

zachrose2• 12 years ago

If HTTP is a bad fit for RPC interfaces, is there something that is a better fit?

jholman4• 12 years ago

YES! (though I'd quibble with s/sometimes/usually/)

To reply to my siblings:

HTTP is in practice a great transport protocol, because of the world we live in. That's an affront to ivory tower engineering (my favorite kind), but it's a lot better than failure to ship (or shipping something that only works under non-existent conditions).

And RPC needs some kind of container protocol, and SOAP is one possibility, sure. Keep it the hell away from ME, but it's one option. The sane option is to do just what all these so-called RESTful services actually do (modulo not using GET when you should POST), with pleasant-but-not-dogmatic URIs, and JSON, and so forth, and just stop calling it REST, because it's not REST at all. Or call it whatever you like, but get used to endless trolling from pedants like me.

Aside from the bad HTTP verb choice, isn't TFA a pretty reasonable API implementation?

Of course, as sillysaurus noted.... TFA doesn't call it RESTful at all... that was just the HN headline. Oh how we've been trolled.

brianbarker2• 12 years ago

I went through that madness when trying to figure out Hypermedia APIs. Supposedly you're not RESTful without hypermedia, but the whole thing seems crazy when you get into it.

Perhaps, just as JSON became a more functional and popular format than XML we can build a new REST spec that simplifies all this.

zenocon2• 12 years ago

I (really do) hate posting this but I swear every single "REST" or "RESTful" or "REST-ful" API post I see, there's always that guy that chides it for not being pure or REST or "-ful" or something. Do we really care that much? Does the API work? If so, move on...

nevster• 12 years ago

I would love an answer for this. How can we describe an api without just calling it a generic 'web service' - where that may be misinterpreted as being a SOAP web service. And it's not strictly a REST web service.

http://stackoverflow.com/questions/24482179/whats-the-best-a...

dlisboa6• 12 years ago

If every Java program was called functional programming people would probably care as much. It works, so move on...

The main problem is that it's not just a small deviation from REST, but the absolute opposite of it. That's hard to ignore.

Mandatum• 12 years ago

If it doesn't follow the design pattern in some form that it states it does, then it should be referred to as the technological interface it's offered through - in this case a web service.

manicdee2• 12 years ago

The main issue with the quoted example is that GET is intended for non-destructive interaction with no side-effects. Whether you use PUT or POST is a much smaller argument than whether to use GET or something else.

To most people, honking the car's horn is an unwanted side effect.

As has already been pointed out, some browsers will fetch-ahead to ensure that pages appear to load instantly. If you open a page which is a bunch of buttons which do stuff like honk the horn, lock the door, raise the window or open the charging port door, there will be unwanted side effects.

So yes, we do care that much.

TheZenPsycho2• 12 years ago

Some of this is pedantic. But mostly, it's calling out, without much grace, that this API is a failure of a design. Not because it's not [insert buzzword] but because:

1. what happens if you visit a control panel page in chrome? Does chrome spider ahead, eagerly caching the links on the page assuming that visiting a page has no side effects? Have fun silencing your horn and windshield wipers from simply visiting your control page.

2. what happens if chrome then has that "get" url very strongly cached? After spending 10 minutes trying to silence your car from your first visit to the page, the "honk horn" button now does nothing but load the word "true" from the browser cache.

3. what if any of the above happens while you are on the road ? what if some wise guy down the line decides that a car should be designed API first, and your dashboard, pedals and wheel are just one of many potential API clients? Can you really now tolerate using the GET method in ways that it is explicitly documented to not be used?

This isn't just philosophical or quibbling over definitions. Getting this wrong means things actually break in the real world.

haberman3• 12 years ago

Will the browser cache XMLHTTPRequest GET requests? I hadn't realized it would do that.

I agree that if anything between you and the server is going to cache requests then you need well-specified behavior around that. But that particular problem can be solved by a specification much, much simpler than all of HTTP.

I also see that it's useful to know that certain requests will not be state-changing for purposes of pre-fetch. But while I agree this is important for the browser, I question how important it is for APIs. API calls are usually constructed programmatically -- V8 isn't going to start just randomly guessing what XMLHTTPRequests you might come up with next and start fetching them. This is where I think that browser-based paradigms with a human user diverge from programmatic ones.

throwawaykf05• 12 years ago

If the only flaw here is the mis-use of the term "REST", I'd say it could be worse: they could actually try to make it a RESTful API!

I too am not very fond of REST, but for slightly different reasons. While I acknowledge its benefits, I'm afraid REST will go the way of OOP in terms of fad-chasing, resulting in massively over-architected and contrived systems.

brianbarker2• 12 years ago

Let's talk bout the real reason this was posted: YOU CAN HONK THE HORN VIA A REMOTE API!

daliwali• 12 years ago

This API documentation has already been posted here twice today [1].

I remarked how non-RESTful this API is, which may have been the motivation for the title of this submission [2].

[1] https://news.ycombinator.com/item?id=7961944

[2] https://news.ycombinator.com/item?id=7962260

zenocon2• 12 years ago

Hm.. wondering if:

/vehicles/{id}/snooplion/hydraulics/bounce

is idempotent or not?

sockgrant• 12 years ago

Holy fucking pedantics, It's too bad people are focusing on REST.

This API makes me want to have a Tesla. There are so many interesting apps/utilities that can be made with this!

stefan_kendall3• 12 years ago

A company has an API FOR A CAR, and discussion devolves immediately into which characters should be at the start of the HTTP request.

Tesla Model S JSON API

Related Stories