Weishaupt WTC Systemgerät - CAPI - CanApiJson - Command API - CANopen like API
(e.g.: {“ID”:“12345678”,“SRC”:“SYS”,“CAPI”:{“NN”:1,“N01”:{“VG”:“020201258202000101”}}})
Weishaupt gas heating devices (WTC) have a network connector below the “Systemgerät” as follows:
MicroSD card || [CANbus/(eebus?) port] || [Ethernet - RJ45 port] :
_
Normally the right [Ethernet - RJ45 port] is used for connecting your Weishaupt gas heating device with the Weishaupt WEM portal (XMP protocol), so that you can see all values online and change some settings/control your gas heating device inside the WEM portal.
If you would like to get values from a Weishaupt gas heating device for smart home purposes (e.g., using [old/unused] notebooks/tablets as a dashboard) then you normally have to pay for a WEM portal license (every 5 years - 80 EUR) or you can buy a Weishaupt Gateway WEM-Modbus protocol converter device.
This device converts the Weishaupt WTC Systemgerät “language”/protocol to different Modbus TCP registers in your local network, but the protocol converter is very expensive.
Simply analyzing the network packets was the solution to solve the two financial problems described previously (portal costs, protocol converter costs).
Here are the results in short:
A device which can understand the Weishaupt WEM / CANopen-like protocol and which can communicate to the Weishaupt “Systemgerät” (SG / SG1)
will “POST” a message (port:80) like this as a request to the Weishaupt SG1:
POST /ajax/CanApiJson.json HTTP/1.1
Host: 192.168.178.124 (example Weishaupt SG1 IP address)
Authorization: Basic YWRtaW46QWRtaW4xMjM=
Referer: http://192.168.178.124/
Content-Length: 215
Connection: keep-alive**
{"ID":"12345678","SRC":"DDC","CAPI":{"NN":5,"N01":{"VG":"010700254100000100"},"N02":{"VG":"010700253200000200"},"N03":{"VG":"010700253302000200"},"N04":{"VG":"010700253700000200"},"N05":{"VG":"010901263900000100"}}}
Then there will be a response from SG1:
HTTP/1.0 200 OK
Content-Type: application/json
Date: Sun, 22 Feb 2026 19:29:43 +0000
Last-Modified: Sun, 22 Feb 2026 19:29:43 +0000
{"ID":"12345678","SRC":"SYS","CAPI":{"NN":5,"N01":{"VG":"020700254100000100"},"N02":{"VG":"020700253200000200b2"},"N03":{"VG":"020700253302000200ab"},"N04":{"VG":"020700253700000200c4"},"N05":{"VG":"020901263900000100"}}}
As you can see, the JSON technique will be used for the CAN / CAN open like Weishaupt WEM communication protocol - explanations:
ID = ID_number → seems to be the same every time. (Did Weishaupt forget to implement something here? Why so unique: “12345678”?)
SRC = Source of the message/telegram (DDC/SYS / PRT<–(http://admin:Admin123@wem-sg/script/Form_eth_log.js))
PRT = ID_name of the Portal (Web interface / browser : if you change settings at: http://admin:Admin123@wem-sg/ then PRT will be used as ID_name)
DDC = ID_name of the Weishaupt Gateway Modbus-WEM (Direct Digital Control / Direct Digital Controller - Building automation / Gateway)
SYS = ID_name of the Weishaupt “Systemgerät” (SG / SG1)
NN = number of following VG telegrams/ VG messages (max. value seen in the wild: “NN”:10)–> “N01”,“N02”,“N03”,…,“N10” (“NN”:10 means: “N01”{ },…,“N10”{ })
VG = → signals that a CAN frame / VG message / VG telegram with data will follow
…could stand for:
Value Group (Telegram contains multiple values together)
Variable Group (Multiple variables in the CAN frame)
Virtual Group (Logical grouping of data points)
Value / Variable Gateway (Gateway / translator)
Verband- / Verknüpfungsgruppe (German words for: Association / Linked Group)
The main part / the most important thing is the message/telegram after: “VG” - e.g. {“VG”:“02 07 00 2533 02 0002 00ab”} and here is what I could find out:
| CM | MI | MX | OX | OS | VS | VA | (official descriptions and field size: http://wem-sg/script/Form_eth_log.js)
| 1 Byte | 1 Byte | 1 Byte | 2 Bytes | 1 Bytes | 2 Bytes | x Bytes | (field size)
CM cases:(CoMmand)
case 1 (0x01): //GET - numeric value (in this case: “DDC” wants to GET numeric data)
case 2 (0x02): //Response (in this case: “SYS” wants to Response numeric data)
case 3 (0x03): //SET - numeric value
case 4 (0x04): //ACK
case 5 (0x05): //ERROR (details see below in the old research results)
case 17 (0x11): //GETS (get a string)
case 18 (0x12): //RESPONSE STRING
(case 18 (0x12): was incorrectly commented out in: http://admin:Admin123@wem-sg/script/Form_eth_log.js → “case 18: //GETS” )
case 19 (0x13): //SETS (set a string)
case 20 (0x14): //ACK STRING`
1 byte | CM | command
1 byte | MI | CAN ID/group - Module Index : 02 / 07
1 byte | MX | CAN sub-ID/sub-group - Member Index - Module Extension : 00 / 01 /
2 bytes | OX | Object - Object Index : 2541 / 2532 / 2533 / 2537 / 2639 /
1 byte | OS | Offset - Object - Sub-object Index
2 bytes | VS | Value Size - number of bytes to send / to receive: 01 / 02 / 04 / 08 /…
x byte(s) | VA | Value(s) inside the data point / register (temperatures, pressures, states, date, time, etc…)
The local Weishaupt WTC “Systemgerät” web interface (http://admin:Admin123@wem-sg/) also uses the CAN open like API in the background for reading/changing all the displayed settings/values.
Examples with curl (also already available in Windows11):
Weishaupt CanApiJson / Weishaupt CAPI command - get IP address:
curl.exe --http1.1 -H "Connection: keep-alive" -H "User-Agent:" -H "Accept:" -H "Referer: http://wem-sg/" -H "Content-Type:" -u admin:Admin123 -d "{\"ID\":\"12345678\",\"SRC\":\"DDC\",\"CAPI\":{\"NN\":1,\"N01\":{\"VG\":\"010600250800000400\"}}}" http://wem-sg/ajax/CanApiJson.json
→ response:
{"ID":"12345678","SRC":"SYS","CAPI":{"NN":1,"N01":{"VG":"0206002508000004c0a8b27c"}}}
→ c0 a8 b2 7c
→ 192.168.178.124
Weishaupt CanApiJson / Weishaupt CAPI command - get hostname:
curl.exe --http1.1 -H "Connection: keep-alive" -H "User-Agent:" -H "Accept:" -H "Referer: http://wem-sg/" -H "Content-Type:" -u admin:Admin123 -d "{\"ID\":\"12345678\",\"SRC\":\"DDC\",\"CAPI\":{\"NN\":1,\"N01\":{\"VG\":\"110600250500001000\"}}}" http://wem-sg/ajax/CanApiJson.json
→ response:
{"ID":"12345678","SRC":"SYS","CAPI":{"NN":1,"N01":{"VG":"1206002505000010WEM-SG"}}}
→ WEM-SG
Weishaupt CanApiJson / Weishaupt CAPI command - reading the heating water buffer tank temperature_top (“Pufferspeicher Temperatur oben”) (01 01 00 2560 02 0002 00):
curl.exe --http1.1 -H "Connection: keep-alive" -H "User-Agent:" -H "Accept:" -H "Referer: http://wem-sg/" -H "Content-Type:" -u admin:Admin123 -d "{\"ID\":\"00000001\",\"SRC\":\"DDC\",\"CAPI\":{\"NN\":1,\"N01\":{\"VG\":\"010100256002000200\"}}}" http://wem-sg/ajax/CanApiJson.json
→ response:
{"ID":"00000001","SRC":"SYS","CAPI":{"NN":1,"N01":{"VG":"02010025600200020212"}}}
→ {“VG”:"…212 = 212Hex = 535 decimal = 53.5 °C / degrees Celsius
→ As you can see, ID: 1 is also possible (not only the default ID: 12345678)
Weishaupt CanApiJson / Weishaupt CAPI command - reading the heating water buffer tank temperature_bottom (“Pufferspeicher Temperatur unten”) (01 01 00 2561 02 0002 00):
curl.exe --http1.1 -H "Connection: keep-alive" -H "User-Agent:" -H "Accept:" -H "Referer: http://wem-sg/" -H "Content-Type:" -u admin:Admin123 -d "{\"ID\":\"00000001\",\"SRC\":\"DDC\",\"CAPI\":{\"NN\":1,\"N01\":{\"VG\":\"010100256102000200\"}}}" http://wem-sg/ajax/CanApiJson.json
→ response:
{"ID":"00000001","SRC":"SYS","CAPI":{"NN":1,"N01":{"VG":"020100256102000201e4"}}}
→ {“VG”:"…1E4 = 1E4Hex = 484 decimal = 48.4 °C / degrees Celsius
In conclusion, you just need the table where the “magic” bytes / “magic” VG telegrams are described to realize a generic (for example with curl) local network access and an access with Home Assistant.
Trying to publish the whole table in the loxwiki-format did extremely slow down my computer and it also could slow down your browser while displaying.
So just the beginning of the table is described here:
More background information, the complete Weishaupt CAPI / CanApiJson table, the project page and how the table was realized is available here:
Update:
It seems to be, that following devices (including the Systemgerät) can “speak” the Weishaupt CAPI CanApiJson protocol:
“Gateway WEM-Modbus” (Weishaupt 48300002722)
“Gateway WEM-KNX” ( 48300002012 )
“PC-Tool WEM- Diagnose” ( 48300000722 )