Just trying to put down the information I've found so far for anyone interested. At this point it's pretty much a list of random pieces of information.
The latest software seems to be posted here:
https://www.webel-online.se/wifi/
To upload the zip package this url is used: http://<glb-ip>:8080/update/
You can download the update package, unzip it and poke around. There's a few bash scripts and a few jsp packages that probably can be edited as well as some java class that easily can be decompiled. I have not tried altering anything yet but maybe the files can be altered and then uploaded.
The java classes used when updating runs the bash scripts which performs the actual update: downloadandupdate.sh and updaterscript.sh
The tomcat manager is avalable here: http://tomcat:tTeFxaYBR73Y@<glb-ip>:8080/manager/
/var/lib/tomcat8/webapps/ROOT/index.html
For security reasons, using the manager webapp is restricted to users with role "manager-gui". The host-manager webapp is restricted to users with role "admin-gui". Users are defined in /etc/tomcat8/tomcat-users.xml.
The jsp uses these three urls on port 2222 (probably the ssh tunnel mentioned by zadiraines, there is a cronjob running for usr/local/bin/create_ssh_tunnel.sh) for getting current status as previously mentioned. I haven't looked to much into the json response but at least the current charge current/power can be read which currently is not shown in the GUI (1.2.2). The 13 digit timestamp at the end of the url is perhaps used for statistics but I'm not sure. It's not needed to get the json response but should probably be properly posted when writing any integrations.
For the box with the pi the first url is used. This seems to be called every second from the GUI.
http://<glb-ip>:2222/rest/chargebox/config?_=<13-digit-timestamp>
For the slave boxes (and also the master apparently): This URL is called roughly every 30 seconds.
http://<glb-ip>:2222/rest/chargebox/slaves/false?_=<13-digit-timestamp>
To get the available info from any load balancing "house" power meters us the modbus id as follows. This URL is also called roughly every 30 seconds.
http://<glb-ip>:2222/rest/chargebox/meterinfo/CENTRAL100?_=<13-digit-timestamp>
I have the intention to open up my box to dump the sd card some day but currently this is not a priority. You could probably add your ssh key to the sd card as previously suggested or alter one of the bash scripts to add a sudo user to get ssh access after pushing an update. I don't want to try the update route without dumping the sd card first though.
I haven't looked into the network activity much but I know that this is used for checking for new firmware. It is hard coded in the hosts file like this:
85.11.39.104
www.webel-online.se
Also, the url
https://chargebox.webel.se/ is used for "easy access" to your web GUI which means the glb communicates with this server. Lookup shows it actually resolves to the same ip (85.11.39.104).