PyControl4 is just a lightweight wrapper for the Web API, you can use any language to make the http requests.
Basically you authenticate using your my.control4.com account, then get a token, you then use this to get a token for the director. Then you can send any command you want to the director.
Easiest way to work out what happens is to run a proxy like burp or zap, setup your phone to proxy requests through it, then just run the app and see all the requests on the proxy.
As I said the downside is that you don't see the status changes coming back, with a sniffer you can see they come through the os notification mechanism which is going to be really hard (maybe impossible) to emulate.There is a websocket interface on the controller (using socket.io format) which does send these, but you need to authenticate to it with the root password, which is easy on 3.1.0, but with the changes for this in later versions its going to be quite a bit of work to get around.