x8000 HomeAssistant API
Good morning, I’m trying to configure a custom component to manage two x8000 (V1) thermostats in homeassistant. Everything works correctly except the synchronization with the Legrand cloud: the thermostats are correctly associated and seen by the API but then they do not synchronize. I wanted to know which subnets should be whitelisted in the cloudflare tunnel that manages my external connection. I’ve added all this but I would like to keep it clean removing unneccesary:
Australia Australia East 20.37.194.0/24
Australia South East 20.42.226.0/24
Brazil Brazil South 191.235.226.0/24
Canada Central Canada 52.228.82.0/24
Asia Pacific Southeast Asia (Singapore) 20.195.68.0/24
India South India 20.41.194.0/24
Central India 20.204.197.192/26
United States Central United States 20.37.158.0/23
West Central United States 52.150.138.0/24
East United States 20.42.5.0/24
East 2 United States 20.41.6.0/23
North United States 40.80.187.0/24
South United States 40.119.10.0/24
West United States 40.82.252.0/24
West 2 United States 20.42.134.0/23
West 3 United States 20.125.155.0/24
Europe Western Europe 40.74.28.0/23
North Europe 20.166.41.0/24
United Kingdom United Kingdom South 51.104.26.0/24
Hello Davide,
As our Cloud servers are based in the Netherlands I would say Western Europe
Have a good day,
Leslie – Community Manager
<p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>Hi,</p><p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>I’m trying to connect my Bticino Smarther X8000 thermostat via the Smarther legacy v2.0 API (Starter Kit for Legrand APIs subscription) using the <code class=”bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]”>bticino_x8000_component Home Assistant integration.</p><p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>Issue: Every token refresh / new authorization attempt fails with:</p><div class=”relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100″ tabindex=”0″ role=”group” aria-label=”Code”><div class=”sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right”><div class=”absolute right-0 h-8 px-2 items-center inline-flex z-10″> </div></div><div class=”overflow-x-auto”>
<code style="color: #14181f; background: transparent; font-family: var(--font-mono); white-space: pre-wrap;">HTTP 429
{ "message": "Rate limit is exceeded", "code": 7 }
</div></div><p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>What I’ve already tried:</p><ul class=”[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3 print:block print:space-y-1″ dir=”ltr”><li class=”font-claude-response-body whitespace-normal break-words pl-2″>Completely removed the integration/client from Home Assistant and made zero API calls for several days.<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Re-authorized from scratch (fresh authorization code, used immediately) — still get the 429 immediately on the very first token request.<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Verified I’m authenticating with my Home + Control / Bticino app end-user account (same email as in the mobile app), not my developer account.<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Tested with both Primary and Secondary subscription key.<p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>Since the Starter Kit is supposed to allow 500 calls/day/user, and I’ve made no calls at all for several days before this latest attempt, this doesn’t look like a normal rate-limit window — it looks like my subscription or account may be flagged/blocked.</p><p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>Details:</p><ul class=”[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3 print:block print:space-y-1″ dir=”ltr”><li class=”font-claude-response-body whitespace-normal break-words pl-2″>Client ID: <code class=”bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]”>9b26b32f-5f4f-4b4c-b342-400bb996e620<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Subscription: Starter Kit for Legrand APIs<li class=”font-claude-response-body whitespace-normal break-words pl-2″>API: Smarther legacy v2.0<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Auth issuer: <code class=”bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]”>login.eliotbylegrand.com<p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>Could someone check whether my subscription/client has an active block or reduced quota, and confirm whether the “legacy” auth path has different (lower) limits than the current Smarther v2.0 API?</p><p> </p><p class=”font-claude-response-body break-words whitespace-normal” dir=”ltr”>Thanks in advance!</p>
<p>Sorry. I post again:</p><p>I’m trying to connect my Bticino Smarther X8000 thermostat via the Smarther legacy v2.0 API (Starter Kit for Legrand APIs subscription) using the bticino_x8000_component Home Assistant integration.</p><p>Issue: Every token refresh / new authorization attempt fails with:</p><p>HTTP 429</p><p>{ “message”: “Rate limit is exceeded”, “code”: 7 }</p><p>What I’ve already tried:</p><p>Completely removed the integration/client from Home Assistant and made zero API calls for several days.</p><p>Re-authorized from scratch (fresh authorization code, used immediately) — still get the 429 immediately on the very first token request.</p><p>Verified I’m authenticating with my Home + Control / Bticino app end-user account (same email as in the mobile app), not my developer account.</p><p>Tested with both Primary and Secondary subscription key.</p><p>Since the Starter Kit is supposed to allow 500 calls/day/user, and I’ve made no calls at all for several days before this latest attempt, this doesn’t look like a normal rate-limit window — it looks like my subscription or account may be flagged/blocked.</p><p>Details:</p><p>Client ID: 9b26b32f-5f4f-4b4c-b342-400bb996e620<br />Subscription: Starter Kit for Legrand APIs<br />API: Smarther legacy v2.0<br />Auth issuer: login.eliotbylegrand.com</p><p>Could someone check whether my subscription/client has an active block or reduced quota, and confirm whether the “legacy” auth path has different (lower) limits than the current Smarther v2.0 API?</p><p>Thanks in advance!</p>
<p>Same problem here – identical setup and identical error.</p><p> </p><p>BTicino Smarther X8000 (first series), Smarther legacy API, Starter Kit subscription, via the bticino_x8000 Home Assistant custom component.</p><p> </p><p>Every authorization/token attempt fails with HTTP 429, body “Rate limit is exceeded”, code 7 – even on the very first token request, on an account left idle for over a day, and even with a brand-new application created today. The Home+Control (lights/shutters) integration on the SAME account works fine – only the Smarther X8000 legacy OAuth token step fails.</p><p> </p><p>This is clearly not a normal rate-limit window – it looks like an account/subscription-level block on the legacy path. Older forum threads show this component authenticated fine back in 2024, so this looks like a recent regression on the legacy API.</p><p> </p><p>Two of us now report the exact same issue. Could a Legrand admin please look into it? I’m happy to provide my account email and Client IDs privately.</p><p> </p><p>Thanks!</p>
Hello,
We performed some tests and checked the logs, we don’t see any problem on our API side. Other users haven’t contacted me about a similar problem. Also, our quota rules haven’t changed for years
Our calls API rate causing a 429 error are the following :
- 500 calls per minute
- 1000 calls per hour
- 10 calls per minute in case of 4xx error codes returned
My guess is that for any reason the bticino_x8000_component fails to correctly perform the token request, send it in a loop, and finally reach the 10 calls per minute quota
As it’s a third-party service we are not linked to them or to their development. I invite you to contact directly the developer : https://github.com/andrea-mattioli/bticino_x8000_component/issues
Have a good day,
Leslie – Community Manager
Hello Leslie,
thank you for your answer. Following your suggestion I contacted the developer of the third-party component, but in the meantime I ran the whole flow manually, without any third-party software, and I would like to share the results because they point to something on the account/subscription side.
- The OAuth flow works
GET
returns the authorization code correctly after login and scope acceptance.
POST
https://partners-login.eliotbylegrand.com/token
(client_id, client_secret, grant_type=authorization_code, redirect_uri, code sent as form data)
returns HTTP 200 with a valid access_token, a refresh_token, and the expected scopes:
“scp”: “topology.read comfort.write comfort.read”
So authentication is not the problem.
- Every API call returns 401
Using that fresh access token:
GET
https://api.developer.legrand.com/smarther/v2.0/plants
Authorization: Bearer <access_token>
Ocp-Apim-Subscription-Key:
Response:
HTTP/1.1 401 Unauthorized
{“statusCode”:”401″,”message”:”Unauthorized”}
I get exactly the same result using the secondary key.
- Your own “Try it” console also returns 401
This is the key point. On portal.developer.legrand.com, API Reference, Smarther legacy v2.0, operation Plants, with:
- Authorization flow: authorization_code (your console handled the login and filled the Authorization header itself)
- Subscription key: Primary: home assistant
pressing Send returns:
HTTP/1.1 401 Unauthorized
warning: Unauthorized
http.status: 401
service_release: 3.27.1
{“statusCode”:”401″,”message”:”Unauthorized”}
So the request is rejected using your own token, your own subscription key and your own tool.
No third-party software is involved at this point.
- Subscription status
In My Subscription the subscription named “home assistant” is listed as Active, product Starter Kit, with both a primary and a secondary key. The application was approved on 2026-06-08 with scopes topology.read, comfort.read and comfort.write all enabled.
Question
Since the token is issued correctly with the right scopes, and the subscription shows as Active, could you please check on your side whether my subscription is actually entitled to call the Smarther v2.0 endpoints?
From the outside everything looks correctly configured, yet every call, including the ones made from your own console, is rejected with 401.
I am happy to provide client id, subscription name or any request/response trace you need.
Thank you,
Marco
You must be logged in to reply to this topic.
6 replies 
4 participants