Hi Bruce, you are right 
and that’s good, because it seems it is simply the same
Just the layzspa method has some kind of gateway in between the communication with gizwits as it seems. You need additionally the AppID in the Bestway App case.
It was quite easy even without sniffing the traffic. I took the Bestway Android APK and unzipped it. Find relevant informations in assets/www/main.js 
The relevant ones:
- The first IDs block works for me and eu server
First:
iosAppSecret:"13482b824b934003a8d95106d3d28eeb"
androidAppSecret:"1d69eda66af64662a6f1b31f0b42eab2"
androidAppID:"98754e684ec045528b073876c34c7348"
iosAppID:"43424551921d4ee18dd279140e11e198"
- Alternative - maybe for other servers?:
iosAppID:"f50095a20a2f4152a3685a01a863ec5a"
iosAppSecret:"20438225160440b7b5a8d87ed8abcad7"
androidAppID:"afb8f41dbb274cb19d0fdf472945fbf3"
androidAppSecret:"3d81fcd4c22e48a286c26a6b3bf29a5b"
Then just use curl for a first test - see the heatzy document in my last post:
1.
curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'X-Gizwits-Application-Id: 98754e684ec045528b073876c34c7348' -d '{ "username": "[email protected]", "password": "YOURPASSWORD", "lang": "en" }' 'https://euapi.gizwits.com/app/login'
and receive
{ {"token": "YOUR_TOKEN", "uid": "YOUR_UID", "expire_at": } }
- get bindings infos with token
curl -X GET --header 'Accept: application/json' --header 'X-Gizwits-User-token: YOUR_TOKEN' --header 'X-Gizwits-Application-Id: 98754e684ec045528b073876c34c7348' 'https://euapi.gizwits.com/app/bindings?limit=20&skip=0'
and receive something like that
{"devices": [{"protoc": 3, "ws_port": 8080, "port_s": 8883, "is_disabled": false, "gw_did": null, "wifi_soft_version": "WIFI_SOFT_VERSION", "dev_alias": "Milan", "mesh_id": null, "is_online": true, "host": "eum2m.gizwits.com", "sleep_duration": 0, "dev_label": [], "port": 1883, "remark": "", "did": "YOUR_DID", "mac": "YOUR_MAC", "product_key": "YOUR_PRODUCT_KEY", "wss_port": 8880, "state_last_timestamp": TIMESTAMP, "role": "owner", "is_sandbox": false, "passcode": "YOURPASSCODE", "type": "normal", "product_name": "SPA", "is_low_power": false}]}
- get the supported Data points
curl -X GET --header 'Accept: application/json' --header 'X-Gizwits-Application-Id: 98754e684ec045528b073876c34c7348' 'https://euapi.gizwits.com/app/datapoint?product_key=YOUR_PRODUCT_KEY'
and receive the supported data type and attributes.
-
get the current values of the attributes e.g. temp_now
curl -X GET --header 'Accept: application/json' --header 'X-Gizwits-Application-Id: 98754e684ec045528b073876c34c7348' 'https://euapi.gizwits.com/app/devdata/YOUR_DID/latest'
-
e.g. set temperature to 23 degrees (temp_set)
curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'X-Gizwits-User-token: YOUR_TOKEN' --header 'X-Gizwits-Application-Id: 98754e684ec045528b073876c34c7348' -d '{"attrs": {"temp_set": 23} } ' 'https://euapi.gizwits.com/app/control/YOUR_DID'
With those infos it should not be that big deal to get back control
Btw the whole thing here looks like MQTT…port 1883…eum2m.gizwits.com…maybe MQTT-Broker M2M…
-> inline update: yes mitt…mentioned here: https://docs.gizwits.com/en-us/cloud/OpenAPI.html
Would be a direct MQTT connection possible?! Perhaps a local connection to the “egg”? I’ll do some research on that…
Enjoy
Best Chris
P.S.: Maybe its possible to get back control of your app with the informations and the api calls
