# Everything Has an API If You're Willing to Prompt > Pulling my workout data from Boostcamp with an AI agent. - **Published**: 2026-09-09 - **Author**: Bagas Wastu - **URL**: https://wastu.net/blog/everything-is-an-api ## Article I’ve been using an app called Boostcamp for at least 3 years to track my workouts, and honestly, it does a great job. But, the problem is that the deep analytics are locked behind a subscription paywall. ![All analytics locked behind a paywall](/articles/everything-is-an-api/boostcamp-paywall-carousel.png) Quite frustrating, and this happens with almost every service. They hold your data hostage inside the app, and you're stuck with whatever they decide to show you. Even if I paid them $50/year for subscription, they still wouldn't let me export my training logs. I was inspired recently seeing people use AI agents to reclaim things they own, like [having Codex reverse-engineer studio lights](https://www.youtube.com/watch?v=FCCmgRpX5ys) or [taking a Samsung TV from a browser sandbox all the way to root](https://blog.calif.io/p/codex-hacked-a-samsung-tv). Before AI, my instinct was always to reverse-engineer the app myself whenever I wanted my data back. But let's be honest, who wants to spend hours after work digging through network requests and databases just to get a CSV? Luckily, an AI agent can do all the tedious work in minutes. ## The Setup I already have an old Xiaomi Poco F4 that's rooted with KernelSU dedicated to things like this. ![My rooted Xiaomi Poco F4](/articles/everything-is-an-api/poco-f4-desk.jpg) The phone is connected to my private network through [meshflare](https://github.com/bgwastu/universe/tree/main/experiments/meshflare) (my project that brings a Tailscale-like mesh network to Cloudflare Zero Trust), running my fork of [wadbd](https://github.com/bgwastu/wadbd) so wireless ADB stays active across reboots and is bound strictly to the VPN interface. To keep the agent on track, I set up two things: 1. **The Model:** DeepSeek V4 Flash. It's fast, cheap, and surprisingly cooperative (more on why below) 2. **The “grill-me" skill:** I attached my “[grill-me](https://github.com/bgwastu/universe/tree/main/agents/skills/grill-me)” skill so the agent interviews me first about what data I actually want about before touching anything Then I just pointed it at the phone over wireless ADB. ## Pulling 3 Years of Data Because the phone is rooted, there was no need to decompile the app or do anything crazy. The agent hopped on over ADB, inspected the app's local storage, and grabbed my active Firebase auth credentials and refresh token. From there, the agent wrote a standalone Python script to query Boostcamp's private API directly. In less than 10 minutes, it dumped and normalized all 339 of my lifetime workouts (5,069 sets) into clean JSON and CSV files, matching my exact app stats. Then, my agent just built single-file dashboard canvas to visualize my full lifting history: ## Closing the Loop Looking at my logs, the agent noticed that because I only lift around 1.6 times a week, causing some muscle groups to stall. So I asked the agent to design two new full-body routines tailored to my actual equipment: - **A Gym Routine:** grouped into 3 physical stations so I don't have to walk around hogging machines - **A Home Routine:** quick, dumbbell-only, with minimal plate changes and no bench needed Best of all, I didn't have to manually configure these exercises back into my phone. The agent used Boostcamp's own internal API to archive my old stalled program and push both new routines straight into my app as native workout templates. ![Custom templates that Agent created on Boostcamp](/articles/everything-is-an-api/templates-carousel.png) Now I have a personal dashboard, three years of clean workout history in my own database, and an agent that updates my routine whenever I need it, all without paying for a subscription :) --- ## If You Try This Yourself ### Pick models that don't over-refuse Most Western frontier models refuse outright the moment you ask them to inspect app storage or reverse-engineer an APK on your own device. Models like GLM or DeepSeek tend to have [far fewer false-positive refusals](https://news.ycombinator.com/item?id=49459654) when inspecting your own hardware. I used DeepSeek V4 Flash because it's fast, cheap, and doesn't lecture me about poking around my own phone. ### Use an old phone instead of an emulator Emulators seem convenient until you run into Play Integrity bans, missing hardware sensors, or weird rendering bugs. A cheap secondary Android phone rooted with KernelSU or Magisk sits on your desk, runs real hardware, and gives your agent direct root access to app data directories without any spoofing headaches. ### Give your agent reverse-engineering tools If the app you're targeting uses certificate pinning or heavy obfuscation, plain prompting won't cut it. DragonJAR's [Android-Pentesting-Skill](https://github.com/DragonJAR/Android-Pentesting-Skill) equips the agent with pre-made Frida hooks and decompilation workflows so it doesn't get stuck. ### Lock down wireless ADB If you don't want a USB cable tethered to your machine 24/7, the original [wadbd](https://github.com/Magisk-Modules-Alt-Repo/wadbd) module keeps ADB alive over Wi-Fi across reboots. The catch is that stock wadbd listens on all network interfaces (`0.0.0.0`), exposing root ADB to your entire local network. You can use [my fork](https://github.com/bgwastu/wadbd), which patches it to bind strictly to your VPN interface instead.