They seem to have the api base url hardcoded in their firmware[1]. The repo seems to have pretty clear instructions for compiling and flashing modified firmware. From there, it's just a matter of writing a decent server to implement the calls documented in BYOD/S[2] and Private API.[3]