I can confirm that indeed using this user agent bypasses the WAF, and got the binding back online. Thanks for having a look at the APK.
In the meantime I also reached out to Bosch, but have not yet received a reply.
I’m a bit divided in what to do now. Currently the binding is not working. If we fake the user agent pretending to be the app, the binding will probably work for some time, but eventually it might be blocked in some other way. Since the end result is pretty much the same, I suppose we could give it a try.
The only thing worrying me slightly is the risk of wider blacklisting. Bosch could detect our non-app usage pattern, and block the device or user account entirely, so that it would no longer be possible to use the app either.