mikes01666
mikes01666 Removing Internet access will stop OVO/Kaluza or GE remotely fixing the problem.
Probably incorrect. If not they can ask you to reconnect it when they finally wake up, in what could be weeks or months.
I see two options now, and if that's your final view above then only option 1 is valid, although let me try and persuade you of option 2.
1) If that's your stance then you have no way of stopping the continued changes yourself at all so just wait for GE OVO etc to get back to you (maybe follow the advice about SARs etc above as they are painful and will get people's attention), bear the cost of the peak charges, or keep on staying awake to cancel them.
2) Here's why, in my humble opinion, I think your statement might be incorrect.
I'll be advised otherwise by others more knowledgeable, but part of your problem is at GE 'head office' (allowing themselves to be a conduit for the requests). Your AIO / inverter itself likely does nothing but report back to GE servers to be run / managed / updated / monitored / set by GE, you, your app, the commercial API etc. Granting others access (eg API) access gives authorized entities access to GE 'head office's published (in this case) commercial API interface, which if the requestor can authenticate properly, will then make GE servers in turn request changes to your AIO settings. This is achieved by GE servers receiving the instructions, checking authorization etc (as documented in their API spec), and then GE passing on the settings changes to your AIO (in a simlar manner as changing on the portal, app etc would do) and also with a note of who/what requested the change, hence the entries in your logs.
The authorization of the access (and your problem) is at GE, not your inverter. I don't think there will be a valid route for instructions for 3rd parties coming direct to your inverter. (There are lots of techy reasons for me assuming this, and although I am not a programmer, I have worked in IT for 35 years). Revokation of the authority can very likely be done with your AIO offline.
OVO etc would have to use the internet accessible commercial API. There is no access to your LAN from the internet to access any local controls / interfaces, these are not exposed to the internet without firewall changes in your Sky router.
References and light reading
GE commercial API https://givenergy.co.uk/software/commercial/commercial-integrations/
GE free API https://givenergy.cloud/docs/api/v1#authenticating-requests
URL of GE API where requests are sent - https://api.givenergy.cloud/v1/ This is not your personal inverter, it's GE servers
An example explanation of using the public / commercial API and explains why some of us are suggesting some of these things to you - https://www.speaktothegeek.co.uk/2023/10/givenergy-ev-charger-and-home-assistant-using-the-cloud-api/
Also posted in reply to @Vestas post (more detail over there) - While typing this and thinking for you it has occurred to me - Possibly OVO have some sort of master API token that allows them to make changes to any inverter if the call includes a correct serial number. This would make it difficult for GE to revoke without co-ordination as it would break every other OVO linked system temporarily, and most worryingly mean GE cannot stop the requests to your inverter without stopping everything OVO linked. In which case your focus needs to be beating up OVO with GE's help? As long as OVO have a valid token (old or new) and keep making API calls with your serial number you're going to have a problem.
I wonder if it's appropriate to summon @TheDragon (GivEnergy) if they have time. Sorry if not proper etiquette, but there are possibly some architectural design / security questions here that might go beyond an individual case.
