Solution
I figured out that the URL returned in the initsession response is wrong. It looked like
this:
https://tpeg.traffic.cit.api.here.com/tpeg/1.0/getmessages?app_id=(yourappid)&v=8&cfg=VOrWft8kgH5SutyP1-ouu2sJnnVOCP8CQSffTHSGyROO0BZeCmQQMk7a1rIM.CqI7hSArRZeW8oJ4xdyeoZ2EWJLnoXHIFOl.BULbBnZmpHhqMZXpJGPILKSolknOi6oDmPucdM8mfTddQRopjUKFlbutXIk9UWO.4KKCUG5xmsXpr4RAEXjW4J4pPn6Ug.FBImacwM2BOT6AYlDUx1.F6aTvn36IF3ERr-ccPndIUZklFdWIVmLEdKD1B3rrpf5
The app_id=... part needs to be replaced as well as the & amp;
it should look like this:
https://tpeg.traffic.cit.api.here.com/tpeg/1.0/getmessages?v=8&cfg=VOrWft8kgH5SutyP1-ouu2sJnnVOCP8CQSffTHSGyROO0BZeCmQQMk7a1rIM.CqI7hSArRZeW8oJ4xdyeoZ2EWJLnoXHIFOl.BULbBnZmpHhqMZXpJGPILKSolknOi6oDmPucdM8mfTddQRopjUKFlbutXIk9UWO.4KKCUG5xmsXpr4RAEXjW4J4pPn6Ug.FBImacwM2BOT6AYlDUx1.F6aTvn36IF3ERr-ccPndIUZklFdWIVmLEdKD1B3rrpf5
Now I struggle with the encryption of the body, the returned key is too long for AES128 and I don't know if the final body should be in plain text format, hex or base64. Also do I need to place the little endian 32 bit integer in binary format? How about the zeros to fill up the string to be divisible by 16, does one zero count as one byte, or do I need to stick with the binary format (8 zeros = one byte)?