CORONA

A rooftop solar system generates a stream of numbers all day — what the panels make, what the house draws, what flows to and from the grid. The hardware is on my roof. The numbers are about my house. But the only way to see them is a phone app that talks to a private server, and there is no export button, no public API, no webhook. The data is real and it is mine and I cannot get at it.

That is not a hardware problem. The numbers are already leaving the house every few minutes — they just travel in a conversation I am not invited to. So the task is not to build a sensor. It is to get invited to a conversation that is already happening.

The app authenticates, then makes a GraphQL call for the current power. Point the phone at mitmproxy once and that whole exchange is visible: the endpoint, the query, the bearer token, and the headers the server uses to decide the caller is the real mobile app. Copy those, and a plain Python script can make the identical request — the server cannot tell the difference, because from where it stands there isn't one.

POST edp-api-graphql.mysunstrong.com/graphql

apollographql-client-name: SunStrongConnectMobile
apollographql-client-version: 1.1.2
originatingfrom: MOBILE
authorization: Bearer •••• (from mitmproxy)

query FetchCurrentPower($siteKey: String!) {
  currentPower(siteKey: $siteKey) {
    production consumption storage grid timestamp
  }
}

// press “run the collector” below

Here is the physics the vendor did not want to hand over, recovered anyway. Production climbs from nothing at dawn to 1.8 kW at midday; watch the grid line cross below zero around noon — that is the house exporting surplus power back to the grid instead of drawing from it. Then it tapers into the afternoon. Every point is a reading the collector actually received.

You may have noticed the cursor sit still for a long time near dawn. That is the honest part. The collector polled 110 times and got back only 7 distinct readings — 63 of those polls returned the identical 07:20 value, because the captured token had expired and the API quietly kept serving the last thing it had rather than an error. The tool's own STALE_DATA_FIX.md names the cause exactly: the bearer token lasts about a day, and there is no automated re-capture yet, so the whole thing goes stale until the phone is put back behind the proxy.

That is why this page charts seven points and labels the poll count on each, rather than drawing a smooth 110-sample line it never actually had. The interesting engineering was getting the door open. Keeping it open — rotating the token without a human and a proxy every morning — is the honest unfinished edge, and pretending otherwise would undo the one thing the project is really about: getting at the truth of the numbers.