Righty-ho, cheers. Here are my thoughts:
The response to this call includes a "requested" field which is the date time of the request. As well as being formatted in the (frankly bizarre) US "middle-endian" date format, it also has no timezone information and appears to be in the EST timezone.
It would be much easier for devs around the world to work with if this was formatted according to the ISO 8601 standard and also was in UTC.
It would be useful if there was a way to list a single device, instead of all of them. For example, I'm working on a project that may have many devices and we need to find the deviceaddress for a given device based on the devicealias. Currently, we do this by calling /device/list/all and iterating through the devices in the response to find the one with the target devicealias. An API call to find that single device by providing its devicealias would obviously be preferable.
The HTTP response status codes seem a little inappropriate. For example, a 401 is probably more appropriate than a 403 for a failed login. Also, a 404 or a 503 may be more appropriate than the 403 used when a /device/connect cannot be actioned because the requested device is offline.