Have someone managed to control the camera from there? such as pan and tilt? It would be awesome if it was possible. I only get an error if i try using the camera.onvif_ptz service.
Seems as you cannot use PTZ feature of this camera unless you use their own Tapo App.
Tried a few different 3:rd party SW’s and they all tell the same; No PTZ support.
“Dear Martin, Thank you very much for requesting information about our product. Sorry to tell you the Tapo C200 supports standard ONVIF protocol (Profile S), but it didn’t support the PTZ. Have a nice day.”
and this:
“Hello, we can use the third party to play the live stream as the FAQ claimed; while it does not support PTZ yet. https://www.tp-link.com/support/faq/2680/ Instead, we need use the Tapo APP to use this feature.”
Their answer to me was not that promising though :
" Hello Harry, Users can only use the pan/tilt function for the Tapo C200 on the Tapo app, the PTZ feature will be unavailable on third-party software like iSpy, ONVIF Device Manager, Happytime Onvif Client, etc. There is no plan to add support for PTZ on third-party software due to hardware restrictions.
Hope there is an opportunity to “work” with you in the near future.
Good day."
It seems more promising.
In the meantime, I have used Tasker, AutoRemote and AutoInput and a spare phone running nonstop to set different marked positions in the app.
With this solution, it takes around 20 to 60 seconds to adjust pan/tilt, which is not that bad since I use it to move it to wall when we come home and move it back look at the room when we are away.
Yes, I did block the camera in firewall so it doesn’t have a WAN connection and then expose it via Home Assistant only.
I have the camera in bedroom so its just to make extra sure, also the feeling of having camera pointed to you is not comfortable
Hi, I also have this camera and I’m pretty concerned about privacy, if you lock the camera on your firewall are you able to control the camera and see the feed trough the tapo app?
This is write-up what actually you can do with a Tapo C200 camera without the the Tapo app, and someone might want to carry on the research and make a functional integration of it.
A few days ago, I’ve bought a Tapo C200, brilliant little device for the price, but I couldn’t believe that it cannot be controlled under HA, I’ve searched a lot and couldn’t find any information about any API what the device would use, but actually it has one.
I ran into an article from NCC Group, about a research on multiple IP cameras, including the Tapo C200 as well. They have found a vulnerability (Heartbleed) in the implementation of the device which has been fixed since that, thank you for those good people there. But that is not really the point here, instead the article contained some documentation how they managed to get access to the Tapo C200.
Here is the article if you want to read it, and make sure you update your firmware!
So, they introduced a method called stok method. Once the user authenticated towards the camera on https (port 443), the camera gives back a stok value, what can be used further on to interact with the camera’s API. Nicely, everything is JSON formatted, and easy to read and handle.
The method to get the stok value is to do a POST to the camera through https as follows:
POST / HTTP/1.1
Host: CAM_IP
Referer: https://CAM_IP:443
Accept: application/json
Accept-Encoding: gzip, deflate
User-Agent: Tapo CameraClient Android
Connection: close
requestByApp: true
Content-Type: application/json; charset=UTF-8
{
"method": "login",
"params": {
"hashed": true,
"password": "MD5 HASH of the password, with ALL Capital Letters",
"username": "admin"
}
}
Here to note the password is the password, what you have registered your user before in the Tapo app. The password has to be MD5 hashed, and capitalized to make it work. (I used Postman to test all of these.)
The stok value changes time to time, it has about 30-60 minutes expiration time. So it has to be renewed.
How to use the stok value, do another POST:
POST /stok=023c3bb0bff01dd799c1f4c7f406d9f5/ds HTTP/1.1
Host: CAM_IP
Referer: https://CAM_IP:443
Accept: application/json
Accept-Encoding: gzip, deflate
User-Agent: Tapo CameraClient Android
Connection: close
requestByApp: true
Content-Type: application/json; charset=UTF-8
{"method":"get", "function":{"name": ['module_spec']}}
This time the address will have /stok=023c3bb0bff01dd799c1f4c7f406d9f5/ds added to it. Everything else goes into the body of the POST.
The original article list some nice commands how to rotate the camera, turn on and off the mask, and some nasty stuff as well, but not so many commands. So I started a hunt for more commands, and found a small repo on GitHub, which listed a few more:
Not so much, but a good start. It was designed for some TPLink device 2 and a half year ago. Indeed it uses a different method for the login, but again uses the stok value.
I’ve played around with it, and all works nicely, the camera can be rotated and so on. But I couldn’t believe that that must be it, so dug deeper on GitHub, and found another repo, which should be a controller for a Mercury camera.
Oh, this is a big hit, it has plenty more data to go further:
The original repo:
Some further developed version for Mercury cameras and HA:
All great work, but mostly based on this research:
All the Mercury IPC Control uses a rsa encryption method for logging in and getting the stok value, what I haven’t tested, probably it would work as well, as all indication suggest the same API on the Tapo C200 as on the Mercury camera.
Most of the commands listed in these repos are working well, except the greeter one.
Unfortunately, I couldn’t find the following yet:
-Get motion events from the camera, either by polling or changing the push address.
-Get a still image from the camera (it should be possible as the Tapo app capable to make images)
-Be able to change the Wifi network details, AP and Password
-Get a full list of methods, functions, parameters, tables and names of the API.
If anyone has the knowledge to do some more research maybe by WireShark, to capture some further commands, or have any idea what API is in use with these cameras and knows a documentation somewhere hidden in a dark corner of the web, then please don’t hesitate to post here.
I have a belief that the same method should work with the Tapo C100 cameras as well, and maybe with the Tapo P100 plugs too. Just need to dig further into the API to get the right commands.
I really hope this will give some traction to get a working integration for these little dirt cheap superb cameras.
I have to say thank you for the initial research on the Tapo C200 to Dale Pavey (@Dpavey) from NCC Group, and @likaci for the research on the Mercury camera. And @ttimasdf for the additional work on the Mercury camera. Thanks for all the great work!
Just to get a notification, I tag a few people from the topic, who might be interested as well:
