x8000 HomeAssistant API

15 February 2024 at 11 h 24 min

Good morning, I’m trying to configure a custom component to manage two x8000 (V1) thermostats in homeassistant. Everything works correctly except the synchronization with the Legrand cloud: the thermostats are correctly associated and seen by the API but then they do not synchronize. I wanted to know which subnets should be whitelisted in the cloudflare tunnel that manages my external connection. I’ve added all this but I would like to keep it clean removing unneccesary:

Australia     Australia East     20.37.194.0/24
Australia South East     20.42.226.0/24
Brazil     Brazil South     191.235.226.0/24
Canada     Central Canada     52.228.82.0/24
Asia Pacific     Southeast Asia (Singapore)     20.195.68.0/24
India     South India     20.41.194.0/24
Central India     20.204.197.192/26
United States     Central United States     20.37.158.0/23
West Central United States     52.150.138.0/24
East United States     20.42.5.0/24
East 2 United States     20.41.6.0/23
North United States     40.80.187.0/24
South United States     40.119.10.0/24
West United States     40.82.252.0/24
West 2 United States     20.42.134.0/23
West 3 United States     20.125.155.0/24
Europe     Western Europe     40.74.28.0/23
North Europe     20.166.41.0/24
United Kingdom     United Kingdom South     51.104.26.0/24

Leslie – Community Manager

15 February 2024 at 13 h 44 min

Hello Davide,

As our Cloud servers are based in the Netherlands I would say Western Europe

Have a good day,

Leslie – Community Manager

Metzler Lukas

5 August 2026 at 17 h 26 min

Hi,I’m trying to connect my Bticino Smarther X8000 thermostat via the Smarther legacy v2.0 API (Starter Kit for Legrand APIs subscription) using the <code class=”bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]”>bticino_x8000_component Home Assistant integration.Issue: Every token refresh / new authorization attempt fails with:<div class=”relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100″ tabindex=”0″ role=”group” aria-label=”Code”><div class=”sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right”><div class=”absolute right-0 h-8 px-2 items-center inline-flex z-10″> </div></div><div class=”overflow-x-auto”>

<code style="color: #14181f; background: transparent; font-family: var(--font-mono); white-space: pre-wrap;">HTTP 429
{ "message": "Rate limit is exceeded", "code": 7 }

</div></div>What I’ve already tried:<ul class=”[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3 print:block print:space-y-1″ dir=”ltr”><li class=”font-claude-response-body whitespace-normal break-words pl-2″>Completely removed the integration/client from Home Assistant and made zero API calls for several days.<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Re-authorized from scratch (fresh authorization code, used immediately) — still get the 429 immediately on the very first token request.<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Verified I’m authenticating with my Home + Control / Bticino app end-user account (same email as in the mobile app), not my developer account.<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Tested with both Primary and Secondary subscription key.Since the Starter Kit is supposed to allow 500 calls/day/user, and I’ve made no calls at all for several days before this latest attempt, this doesn’t look like a normal rate-limit window — it looks like my subscription or account may be flagged/blocked.Details:<ul class=”[li_&]:mb-0 [li_&]:mt-1 [li_&]:gap-1 [&:not(:last-child)_ul]:pb-1 [&:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3 print:block print:space-y-1″ dir=”ltr”><li class=”font-claude-response-body whitespace-normal break-words pl-2″>Client ID: <code class=”bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]”>9b26b32f-5f4f-4b4c-b342-400bb996e620<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Subscription: Starter Kit for Legrand APIs<li class=”font-claude-response-body whitespace-normal break-words pl-2″>API: Smarther legacy v2.0<li class=”font-claude-response-body whitespace-normal break-words pl-2″>Auth issuer: <code class=”bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]”>login.eliotbylegrand.comCould someone check whether my subscription/client has an active block or reduced quota, and confirm whether the “legacy” auth path has different (lower) limits than the current Smarther v2.0 API? Thanks in advance!

Metzler Lukas

6 August 2026 at 9 h 33 min

Sorry. I post again:I’m trying to connect my Bticino Smarther X8000 thermostat via the Smarther legacy v2.0 API (Starter Kit for Legrand APIs subscription) using the bticino_x8000_component Home Assistant integration.Issue: Every token refresh / new authorization attempt fails with:HTTP 429{ “message”: “Rate limit is exceeded”, “code”: 7 }What I’ve already tried:Completely removed the integration/client from Home Assistant and made zero API calls for several days.Re-authorized from scratch (fresh authorization code, used immediately) — still get the 429 immediately on the very first token request.Verified I’m authenticating with my Home + Control / Bticino app end-user account (same email as in the mobile app), not my developer account.Tested with both Primary and Secondary subscription key.Since the Starter Kit is supposed to allow 500 calls/day/user, and I’ve made no calls at all for several days before this latest attempt, this doesn’t look like a normal rate-limit window — it looks like my subscription or account may be flagged/blocked.Details:Client ID: 9b26b32f-5f4f-4b4c-b342-400bb996e620 Subscription: Starter Kit for Legrand APIs API: Smarther legacy v2.0 Auth issuer: login.eliotbylegrand.comCould someone check whether my subscription/client has an active block or reduced quota, and confirm whether the “legacy” auth path has different (lower) limits than the current Smarther v2.0 API?Thanks in advance!

Marco Cosentino

6 August 2026 at 11 h 09 min

Same problem here – identical setup and identical error. BTicino Smarther X8000 (first series), Smarther legacy API, Starter Kit subscription, via the bticino_x8000 Home Assistant custom component. Every authorization/token attempt fails with HTTP 429, body “Rate limit is exceeded”, code 7 – even on the very first token request, on an account left idle for over a day, and even with a brand-new application created today. The Home+Control (lights/shutters) integration on the SAME account works fine – only the Smarther X8000 legacy OAuth token step fails. This is clearly not a normal rate-limit window – it looks like an account/subscription-level block on the legacy path. Older forum threads show this component authenticated fine back in 2024, so this looks like a recent regression on the legacy API. Two of us now report the exact same issue. Could a Legrand admin please look into it? I’m happy to provide my account email and Client IDs privately. Thanks!

Leslie – Community Manager

20 August 2026 at 10 h 58 min

Hello,

We performed some tests and checked the logs, we don’t see any problem on our API side. Other users haven’t contacted me about a similar problem. Also, our quota rules haven’t changed for years

Our calls API rate causing a 429 error are the following :

500 calls per minute
1000 calls per hour
10 calls per minute in case of 4xx error codes returned

My guess is that for any reason the bticino_x8000_component fails to correctly perform the token request, send it in a loop, and finally reach the 10 calls per minute quota

As it’s a third-party service we are not linked to them or to their development. I invite you to contact directly the developer : https://github.com/andrea-mattioli/bticino_x8000_component/issues

Have a good day,

Leslie – Community Manager

Marco Cosentino

22 August 2026 at 10 h 50 min

Hello Leslie,

thank you for your answer. Following your suggestion I contacted the developer of the third-party component, but in the meantime I ran the whole flow manually, without any third-party software, and I would like to share the results because they point to something on the account/subscription side.

The OAuth flow works

GET

https://partners-login.eliotbylegrand.com/authorize?client_id=<my_client_id>&response_type=code&redirect_uri=<my_registered_redirect_uri>

returns the authorization code correctly after login and scope acceptance.

POST

https://partners-login.eliotbylegrand.com/token

(client_id, client_secret, grant_type=authorization_code, redirect_uri, code sent as form data)

returns HTTP 200 with a valid access_token, a refresh_token, and the expected scopes:

“scp”: “topology.read comfort.write comfort.read”

So authentication is not the problem.

Every API call returns 401

Using that fresh access token:

GET

https://api.developer.legrand.com/smarther/v2.0/plants

Authorization: Bearer <access_token>

Ocp-Apim-Subscription-Key:

Response:

HTTP/1.1 401 Unauthorized

{“statusCode”:”401″,”message”:”Unauthorized”}

I get exactly the same result using the secondary key.

Your own “Try it” console also returns 401

This is the key point. On portal.developer.legrand.com, API Reference, Smarther legacy v2.0, operation Plants, with:

Authorization flow: authorization_code (your console handled the login and filled the Authorization header itself)
Subscription key: Primary: home assistant

pressing Send returns:

HTTP/1.1 401 Unauthorized

warning: Unauthorized

http.status: 401

service_release: 3.27.1

{“statusCode”:”401″,”message”:”Unauthorized”}

So the request is rejected using your own token, your own subscription key and your own tool.

No third-party software is involved at this point.

Subscription status

In My Subscription the subscription named “home assistant” is listed as Active, product Starter Kit, with both a primary and a secondary key. The application was approved on 2026-06-08 with scopes topology.read, comfort.read and comfort.write all enabled.

Question

Since the token is issued correctly with the right scopes, and the subscription shows as Active, could you please check on your side whether my subscription is actually entitled to call the Smarther v2.0 endpoints?

From the outside everything looks correctly configured, yet every call, including the ones made from your own console, is rejected with 401.

I am happy to provide client id, subscription name or any request/response trace you need.

Thank you,

Marco

Leslie – Community Manager

2 September 2026 at 14 h 07 min

Hello,

Sorry for the delay in my answer, I needed to perform some tests and talk to the developers first

Did you perform the account linking in the Legrand Thermostat app ? Menu > Account > Third-party access > developer email account linking process

If no, it will cause this 401 error in every call, excepted for authorization and token retrieval

Please follow the process and come back to me if you still face an issue

Have a good day,

Leslie – Community Manager

Marco Cosentino

2 September 2026 at 17 h 36 min

Hello Leslie,

thank you for checking with the developers.

Yes, the account linking is already in place, and it was done before my previous tests. In the Thermostat app, Menu > Account > Third-party access shows the confirmation screen with the green check and the message “Your account is connected to …”, and the address shown there is the same email address as my Works with Legrand developer account. So the link points to the correct account.

After your message I ran the whole flow again from scratch, today:

Authorization — GET https://partners-login.eliotbylegrand.com/authorize with my client_id and one of my registered reply URLs. The consent screen appears correctly, showing my application and the three permissions (plant details, set comfort parameters, read comfort data). I accept.
Token — POST https://partners-login.eliotbylegrand.com/token with client_id, client_secret, grant_type=authorization_code, code and redirect_uri sent as form data. Result: HTTP 200, a valid access_token (1092 characters), a refresh_token, and scopes topology.read + comfort.read + comfort.write.
API call — GET https://api.developer.legrand.com/smarther/v2.0/plants with Authorization: Bearer and my subscription key in the Ocp-Apim-Subscription-Key header.

Result: HTTP 401 — {“statusCode”:”401″,”message”:”Unauthorized”}

I repeated step 3 with both the Primary and the Secondary key of my subscription (product Starter Kit, status Active): both return 401. Passing the key as a ?subscription-key= query parameter returns 404 instead, so that form is simply not accepted by the gateway on this route.

I get the very same 401 from your own “Try it” console on portal.developer.legrand.com, service Smarther v2.0, operation Plants, authorization flow = authorization_code, my Primary subscription key. No third-party software is involved in that test.

To summarise: third-party access linking is in place and points to the correct account, authorization and token retrieval work, the subscription is Active, and the API still returns 401 with your own token, your own key and your own tool.

Could you please check on your side whether my subscription/client is actually entitled to call the Smarther v2.0 endpoints? I would rather not post my client ID, application name and account email in a public thread. Tell me where to send them and I will provide them privately right away, or you can look them up from the email address associated with this forum account.

Thank you,

Marco

Leslie – Community Manager

3 September 2026 at 11 h 01 min

Hi Marco,

Really strange, I tested on my side by linking a brand new Gmail account and I correctly managed to make it work with both Postman and Try-It tool. Everything seems OK in backend with your account and subscription key

Can you please write me here by providing the latest access_token value you generate ?

Thanks and have a good day,

Leslie – Community Manager

Marco Cosentino

14 September 2026 at 11 h 29 min

Hi Leslie, a problem on my side: your “write me here” link returns “Page notfound” even when logged in. I have written to webmaster.legrand@legrand.com asking them to forward thisto you, in case you do not see this message. In the meantime, here is what you need to find the call in your logs: on14 September 2026 at 09:15:18 UTC (11:15:18 Italian time) I generated a tokenwith client_id 2a1d0ee2-7ff7-4e30-a689-3a48840dfd37 and immediately calledGET /smarther/v2.0/plants with my Primary subscription key — answer HTTP 401. Tell me an email address and I will send you a fresh token right away.

Leslie – Community Manager

14 September 2026 at 11 h 34 min

Hello Marco

Please use the email in this link (ww-sm-contact……)

I don’t have direct access to the logs on my side, so the token value would be great 🙂

Have a good day,

Leslie – Community Manager