I automated my Hozelock Cloud Controller with shell scripts which call the (undocumented) cloud API (reverse-engineered from looking at requests made by the android app), I didn’t look at local (ie no cloud dependency) control.
The device has pretty much 0 security, requests to the API have no authentication, and just identify each device by its unique device ID. I raised this issue with Hozelock, and proved it to them by remotely activating a device in their office, but they weren’t at all interested. (never followed up or made any changes to it)
There’s a basic bash script below for turning the controller on/off, the API endpy to start/stop is waterNow/stopWatering. iirc you should be able to play with the API to find all available endpoints
For status & feedback you can make a GET request to
http://hoz3.com/restful/support/hubs/HUBID/, which returns status as JSON.
ACTION=$1
DURATION=$2
PAYLOAD='{"controllerIDs":["0","0"],"duration":'${DURATION}'}'
curl -X POST "http://hoz3.com/restful/foo/hubs/${HUBID}/controllers/actions/${ACTION}" -H 'content-type: application/json' -d $PAYLOAD > /dev/null 2>&1```