API Discovery Session Summary

Collection of articles for working with Multitech devices in LoRaWAN networks.

API Discovery Session Summary

Date: December 17, 2025
Session Focus: Undocumented API Endpoint Discovery
Gateway: MTCAP3-5399867K at 172.16.33.111
Firmware: 7.4.0-BETA2-7-g7e2e653f
API Version: 7.2.0-86-g5ae2b66c

Executive Summary

During this session, we successfully discovered and documented 19+ previously undocumented API endpoints and explored the comprehensive stats monitoring system. All endpoints were tested against a live MTCAP3 gateway and their responses documented.

Key Discoveries

1. Undocumented Configuration Endpoints (19)

The following configuration endpoints were discovered and documented:

  1. autoReboot - Automatic device reboot scheduler
  2. backOffTimers - Cellular retry backoff timers (carrier-specific)
  3. bootloader - Bootloader console and security configuration
  4. brand - White-label branding and OEM customization
  5. cellTimeSync - Cellular network time synchronization
  6. ddns - Dynamic DNS configuration
  7. ipPassthrough - IP passthrough/bridge mode
  8. lldp - Link Layer Discovery Protocol
  9. mdns - Multicast DNS (Bonjour)
  10. radius - RADIUS authentication server
  11. remoteAccess - Remote access security (HTTP/HTTPS/SSH/SNMP)
  12. remoteMgmt - Multi-Tech cloud management integration
  13. resetButton - Physical reset button configuration
  14. smtp - SMTP email server configuration
  15. sntp - NTP time synchronization
  16. waninfo - Real-time WAN interface status (read-only)
  17. wanmngr - WAN failover and load balancing
  18. ipPipes - IP pipe tunnels
  19. notificationEventGroup - Event notification configuration
  20. customAppsConfig - Custom application settings

2. Stats Monitoring System

Discovered comprehensive stats monitoring with 33+ categories:

Key Finding: The stats/dashboard endpoint provides a single comprehensive view of all critical system information.

3. LoRa API Endpoints

Discovered LoRa-specific REST endpoints:

4. Important Findings

Session Management

API Structure Patterns

Security Features Discovered

Testing Results

Endpoint Availability

Device Capabilities (MTCAP3)

Documentation Created

New Documents

  1. UNDOCUMENTED-ENDPOINTS-FINDINGS.md - Comprehensive documentation of 19+ new endpoints
  2. STATS-ENDPOINTS-DISCOVERY.md - Complete stats monitoring system documentation
  3. SESSION-SUMMARY-2025-12-17.md - This summary document

Files to Update

Notable Features Discovered

1. Advanced WAN Management

2. Enterprise Features

3. Cellular Optimization

4. Security Hardening

5. Cloud Integration

API Patterns Identified

Query Patterns

# Single resource
GET /api?fields=<resource>

# Multiple resources
GET /api?fields=<resource1>,<resource2>,<resource3>

# Nested field
GET /api?fields=<resource>/<field>

# Stats category
GET /api?fields=stats/<category>

# Monitoring (no timeout)
GET /api?fields=stats/<category>&inactivity=true

Modification Patterns

# Update resource
PUT /api/<resource>
Content-Type: application/json
{ "field": "value" }

# Create item
POST /api/<resource>
Content-Type: application/json
{ "field": "value" }

# Delete item
DELETE /api/<resource>/<id>

# Execute command
POST /api/command/<action>

Real-World Data Captured

Device Information

LoRa Configuration

Cellular Status

Recommendations

Immediate Actions

  1. ✅ Document new endpoints - COMPLETED
  2. ⏳ Update OpenAPI specification - PENDING
  3. ⏳ Create Postman examples - PENDING
  4. ⏳ Test PUT/POST operations - PENDING
  5. ⏳ Test permission levels - PENDING

Testing Priorities

  1. Permission Testing: Test each endpoint with user/guest roles
  2. Modification Testing: Test PUT/POST/DELETE on new endpoints
  3. Device Compatibility: Test on MTCDT, Conduit, other models
  4. Command Discovery: Look for associated command endpoints
  5. Schema Validation: Validate against JSON schemas

Documentation Priorities

  1. OpenAPI Update: Add all 19+ endpoints to YAML spec
  2. Quick Reference: Add to quick reference guide
  3. Postman Collection: Create example requests
  4. Monitoring Guide: Create monitoring best practices doc
  5. Integration Examples: Python/JavaScript client examples

Technical Insights

API Design Observations

Performance Notes

Security Observations

Questions for Further Investigation

  1. Command Endpoints: Are there command endpoints for new resources?
  2. Bluetooth: What Bluetooth features are available on BT-enabled models?
  3. Docker: Full Docker API when Docker is enabled?
  4. Custom Apps: What’s the custom app installation API?
  5. LoRa Admin: What are the restricted LoRa admin endpoints?
  6. SCADA: What SCADA protocol endpoints exist?
  7. Save/Restore: What’s in the saveAndRestore endpoint?
  8. Help Endpoint: What does the help endpoint provide?

Files Modified/Created

Created

To Be Updated

Session Statistics

Next Session Recommendations

  1. Test Modifications: Test PUT/POST/DELETE on new endpoints
  2. Permission Matrix: Create complete permission matrix
  3. Command Discovery: Find associated command endpoints
  4. Multi-Device Testing: Test on different device models
  5. Integration Examples: Create Python/Node.js client examples
  6. Monitoring Dashboard: Build example monitoring dashboard
  7. Alert Configuration: Test notification event groups
  8. LoRa Deep Dive: Explore LoRa network server API fully

Conclusion

This session successfully expanded the documented API surface by discovering 19+ configuration endpoints and a comprehensive 33+ category stats monitoring system. All discoveries were tested against a live gateway and thoroughly documented. The API demonstrates excellent design consistency and enterprise-grade features.

The mPower Edge Intelligence API is significantly more comprehensive than initially documented, with advanced features for:

Status: Session objectives achieved. Ready for next phase of testing and documentation updates.