Inseego MiFi X 3000 Pro REST API

[Simple Simon]

I am working on access to the M3100 (and others) via their REST API.

I've gathered a few items so far - some are even useful.
These all work on M2000 & M3100.
Note: I use 192.168.2.1 for MiFi (obviously).
http://192.168.2.1/restarting --- If logged in, this will trigger a restart
http://192.168.2.1/srv/status --- This has good stuff like SS/SNR and band.
http://192.168.2.1/apps_home/retrieve
http://192.168.2.1/apps_home/devicesrefresh
http://192.168.2.1/apps_home/usageinfo

I know that Inseego Connect has access to more - like the Tower ID,
but we might not be able to get to that interface (maybe cell-side only).

If someone has a dump of firmware, there may be a list of the endpoints visible.

Anyone interested in this?

[Simple Simon]

First, note that at this point, I am just using a browser to sniff with.
Postman will come in a bit - for example, to programatically login to the MiFi.

Second, I believe that this effort will likely apply to any Inseego whose web interface is similar to a MiFi.
I worked with an FX2000 a while back where that seemed to be the case, but I no longer have access to it.

Finally, here's some more I've found:
192.168.2.1/rest/1.0/SimStatus --- MUST be logged in or 401
{"CurrentSimStatus":"Ready"}

http://192.168.2.1/rest/1.0/WiFi --- 404 -- but gives error msg unlike /rest/1.0/barf which returns nothing but the 404
{"Error":"Operation not allowed due to resource being unsupported"}

http://192.168.2.1/rest/1.0/WiFiSettings --- 501 which is a clue that it might require using POST

[Simple Simon]

A couple of more:
http://192.168.2.1/apps_home/checkforupdate
http://192.168.2.1/apps_home/help - returns http 500 instead of 404

I really could do a lot more with a dump of the firmware data segment(s)!

[Johan-wless]

Thank you for sharing this info! I have long been interested in scheduling restarts of my hotspot, because it intermittently decides to drop Internet connection, even though the admin UI says there is no issue. Just need to figure out how to login remotely, and I'd be all the way there. Thank you again for showing what is possible!

[Simple Simon]

Thank you for sharing this info! I have long been interested in scheduling restarts of my hotspot, because it intermittently decides to drop Internet connection, even though the admin UI says there is no issue. Just need to figure out how to login remotely, and I'd be all the way there. Thank you again for showing what is possible!

I had to set this project aside for a bit, but am getting back on it.
My Inseego collection now includes M2100, M3000, and FX2000e-3.
The REST API seems to be very similar across all of them - but of course only the FX3000e includes SIM2 data items.

I think I have found enough to dive into decoding the logon mechanism which will still need the user-specified admin password.
Even if I discovered a way around that I would not publish it.

I am still trying to find a way to read the current tower ID without using Inseego Connect.
It can read it, but it does not show on the local UI or any REST I've found, and in my situation it's important.
Sure wish I could find a way into the filesystem so I could get a directory dump of the filenames at least.

[Renate]

I've no idea how similar this is to the MiFi 8800L.
I made a CGI module for that that spit out JSON of band, snr, signal without logging in.
That should only be accessible on the LAN side, but some may not like even that.

[Simple Simon]

Sounds like the http://.../srv/status call.
It's what the web page uses (regardless of login status) to get data like:
...
"statusBarBand": "n71",
"statusBarBandwidth": "15 MHz",
...
"statusBarNetwork": "T-Mobile",
"statusBarNetworkID": "310260",
...
"statusBarSNR": "15",
"statusBarSignalBars": "5",
...

[Renate]

Sounds like the http://.../srv/status call.

Yeah, I don't remember at this point whether what I wanted was login restricted.
Estimated data usage was also something desired.

The Netgear LM1200 uses response templates.
To get what you were interested was only available on a big template that took ~300 mS to fill in.
I wrote my own (binary format) template with just what I needed and that took a fraction of the time.
I could have done that as my own CGI, but couldn't be bothered.