So, here we go…
This is write-up what actually you can do with a Tapo C200 camera without the the Tapo app, and someone might want to carry on the research and make a functional integration of it.
A few days ago, I’ve bought a Tapo C200, brilliant little device for the price, but I couldn’t believe that it cannot be controlled under HA, I’ve searched a lot and couldn’t find any information about any API what the device would use, but actually it has one.
I ran into an article from NCC Group, about a research on multiple IP cameras, including the Tapo C200 as well. They have found a vulnerability (Heartbleed) in the implementation of the device which has been fixed since that, thank you for those good people there. But that is not really the point here, instead the article contained some documentation how they managed to get access to the Tapo C200.
Here is the article if you want to read it, and make sure you update your firmware!
So, they introduced a method called stok method. Once the user authenticated towards the camera on https (port 443), the camera gives back a stok value, what can be used further on to interact with the camera’s API. Nicely, everything is JSON formatted, and easy to read and handle.
The method to get the stok value is to do a POST to the camera through https as follows:
POST / HTTP/1.1
Host: CAM_IP
Referer: https://CAM_IP:443
Accept: application/json
Accept-Encoding: gzip, deflate
User-Agent: Tapo CameraClient Android
Connection: close
requestByApp: true
Content-Type: application/json; charset=UTF-8
{
"method": "login",
"params": {
"hashed": true,
"password": "MD5 HASH of the password, with ALL Capital Letters",
"username": "admin"
}
}
Here to note the password is the password, what you have registered your user before in the Tapo app. The password has to be MD5 hashed, and capitalized to make it work. (I used Postman to test all of these.)
The result will be something like this:
{
"error_code": 0,
"result": {
"stok": "023c3bb0bff01dd799c1f4c7f406d9f5",
"user_group": "root"
}
}
The stok value changes time to time, it has about 30-60 minutes expiration time. So it has to be renewed.
How to use the stok value, do another POST:
POST /stok=023c3bb0bff01dd799c1f4c7f406d9f5/ds HTTP/1.1
Host: CAM_IP
Referer: https://CAM_IP:443
Accept: application/json
Accept-Encoding: gzip, deflate
User-Agent: Tapo CameraClient Android
Connection: close
requestByApp: true
Content-Type: application/json; charset=UTF-8
{"method":"get", "function":{"name": ['module_spec']}}
This time the address will have /stok=023c3bb0bff01dd799c1f4c7f406d9f5/ds added to it. Everything else goes into the body of the POST.
The original article list some nice commands how to rotate the camera, turn on and off the mask, and some nasty stuff as well, but not so many commands. So I started a hunt for more commands, and found a small repo on GitHub, which listed a few more:
Not so much, but a good start. It was designed for some TPLink device 2 and a half year ago. Indeed it uses a different method for the login, but again uses the stok value.
I’ve played around with it, and all works nicely, the camera can be rotated and so on. But I couldn’t believe that that must be it, so dug deeper on GitHub, and found another repo, which should be a controller for a Mercury camera.
Oh, this is a big hit, it has plenty more data to go further:
The original repo:
Some further developed version for Mercury cameras and HA:
All great work, but mostly based on this research:
All the Mercury IPC Control uses a rsa encryption method for logging in and getting the stok value, what I haven’t tested, probably it would work as well, as all indication suggest the same API on the Tapo C200 as on the Mercury camera.
Most of the commands listed in these repos are working well, except the greeter one.
Unfortunately, I couldn’t find the following yet:
-Get motion events from the camera, either by polling or changing the push address.
-Get a still image from the camera (it should be possible as the Tapo app capable to make images)
-Be able to change the Wifi network details, AP and Password
-Get a full list of methods, functions, parameters, tables and names of the API.
If anyone has the knowledge to do some more research maybe by WireShark, to capture some further commands, or have any idea what API is in use with these cameras and knows a documentation somewhere hidden in a dark corner of the web, then please don’t hesitate to post here.
I have a belief that the same method should work with the Tapo C100 cameras as well, and maybe with the Tapo P100 plugs too. Just need to dig further into the API to get the right commands.
I really hope this will give some traction to get a working integration for these little dirt cheap superb cameras.
I have to say thank you for the initial research on the Tapo C200 to Dale Pavey (@Dpavey) from NCC Group, and @likaci for the research on the Mercury camera. And @ttimasdf for the additional work on the Mercury camera. Thanks for all the great work!
Just to get a notification, I tag a few people from the topic, who might be interested as well:
@epeome5, @traverst, @krash, @martinwahlstrom, @zbuh, @2t0m, @tavares
