Since September 2026, Bosch/Buderus has also offered a local REST API for Bosch CS5800/6800i and Buderus WLW176/186i heat pumps. The local API requires a Bosch K40 RF or Buderus MX400 Wi-Fi gateway with gateway firmware 15.00.01 or higher.

Hostname or IP address

First, you need the IP address of your K 40 RF or MX400 gateway in your home Wi-Fi network. The easiest way to find the IP address is in your router’s device list. To use the example code from the API preview on this page, enter the hostname or IP address under gatewayAddress, for example gateway.local, K40RF-1acabc or 192.168.1.42—without https://, a port, or a trailing period.

Authentication

Position of Login and Pass on the sticker of the K 40 RF

To use the local API, every request must be authenticated with an Access Token. To issue the Access Token, you need Login and Pass. These can be found on a sticker either on the indoor unit of your heat pump, on the plugged-in Wi-Fi gateway, on the front of the Quick Start Guide, or in the packaging of your Wi-Fi gateway. If you can no longer find the sticker, scan the QR code on the Wi-Fi gateway. It is structured as follows:
V:1;L:<your-login>;P:<your-pass>;MAC:<your-mac-address>;N:<your-gateway-model>

  1. Press the WLAN and wireless buttons on the gateway simultaneously for one second. The LEDs should briefly flash blue.
  2. Replace the variables <your-heatpump-hostname>, <login-on-sticker>, <pass-on-sticker-without-dashes> and <any-name-for-your-client> in the following cURL command and then execute it within five minutes:
   curl \
     --silent --show-error --fail-with-body \
     --insecure \
     --request POST "https://<your-heatpump-hostname>:9442/auth/token" \
     --header "Content-Type: application/x-www-form-urlencoded" \
     --data-urlencode "grant_type=password" \
     --data-urlencode "username=<login-on-sticker>" \
     --data-urlencode "password=<pass-on-sticker-without-dashes>" \
     --data-urlencode "client_name=<any-name-for-your-client>"

The response contains the required value access_token. Enter this value below under Auth → Token, without the preceding word Bearer. The token does not expire and should be stored securely like a password. For 412 physical_proximity_unproven, press the button combination again and repeat the request within five minutes.

For further details, see the official K 40 RF API guide.

API reference

Here you can browse the API documentation and copy cURL or code examples for the endpoints. Open an endpoint and enter your Access Token (without Bearer) under Auth → Token, as well as the hostname or IP address of your K 40 RF gateway under Server Variables → gatewayAddress. The examples update automatically. Direct browser requests remain disabled because of the gateway’s CORS restriction. The token and gateway address are stored locally in your browser.

The cURL examples contain --insecure because the gateway’s certificate does not have a trusted trust anchor.

The OpenAPI file is also available separately.