Ok, the API docs start with: "The devices makes a HTTPS request to product.company.com using a pinned public key." They aren't going to publish their private key or let you control their servers.