Home Assistant Core 2026.9 REST and websocket scripting gotchas

Observed September 2026 on Home Assistant Core 2026.9.1, using Python urllib and websockets 16.

History and logbook API

• /api/history/period/<start> returns only 24 hours unless end_time= is given.
• Write timestamps with a Z suffix. A +00:00 offset is decoded as a space in the query string and the call fails with a KeyError.
• Add no_attributes&minimal_response to shrink payloads.
• /api/logbook/<start>?end_time=&entity=a,b shows who changed an entity: context_entity_id is set for an automation, context_user_id for a person. Both empty indicates a physical input such as a wall switch.
• Python 3.14 on the observed Windows machine had no tzdata, so zoneinfo failed. A fixed dt.timezone(dt.timedelta(hours=12)) worked for NZST.

Helpers via config flow

Pattern: POST /api/config/config_entries/flow with {"handler": "<domain>"}, then POST the form to /flow/<flow_id>. DELETE the flow to abandon it. Read data_schema from the first response rather than guessing fields.

• derivative: name, source, round, time_window{hours,minutes,seconds}, unit_time (s|min|h|d), max_sub_interval. A derivative of a kWh counter with unit_time: h yields kW directly. max_sub_interval makes the value decay when the source stops updating.
• statistics: three steps: {name, entity_id}, then {state_characteristic}, then {sampling_size, max_age, keep_last_sample, precision}. The sensor is unavailable after every load or reload until the source updates within max_age, so a template fallback is needed.
• template sensor: the first POST is {"next_step_id": "sensor"}.
• Helper sensors attached to a source that belongs to a device get the device name prefixed to the entity id. Rename with websocket config/entity_registry/update {entity_id, new_entity_id}.
• input_boolean/create, input_number/create and timer/create over the websocket create plain helpers; entity ids follow the name.
• Generic Camera options flow (/api/config/config_entries/options/flow, handler = entry id) needs an advanced mapping {framerate, verify_ssl, rtsp_transport, authentication}, then a user_confirm step {"confirmed_ok": true}. It probes the stream and returns stream_source: timeout if the camera is dead.

Automations

• POST /api/config/automation/config/<id> with the JSON automation creates or replaces it and reloads automations.
• automation.turn_off persists across restarts, which retires an automation without deleting it.
• Template and numeric_state triggers fire only on a false-to-true transition. For an "off when condition holds" rule where the condition may already be true at start, trigger on the source entity's state changes plus a time_pattern tick and evaluate the condition under conditions, rather than a template trigger with for:.
• Templates can be tested with POST /api/template {"template": "..."} before saving.

Supervisor through the HA proxy

/api/hassio/{supervisor,core,host}/logs, /api/hassio/host/logs/boots/<n> and /api/hassio/addons/<slug>/logs accept the HA token. resolution/info, supervisor/info and host/info return 401; ha core info on the VM console is the alternative.