[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
I think I figured out now what exactly gets sent to the server. The following request is responsible for sending the requests to OPPO's API as far as I can tell:

Once any action is triggered in the app, the app starts a handler like this:

public static void m6041a(Context context, int i, Handler handler) {
Intent intent = new Intent(context, RequestService.class);
intent.putExtra("MessengerFlag", i);
intent.putExtra("Messenger", new Messenger(handler));
context.startService(intent);
}

The handler then registers a RequestService that constructs the url depending on the MessengerFlag:

public int onStartCommand(Intent intent, int i, int i2) {
if (intent == null || intent.getExtras() == null) {
return super.onStartCommand(intent, i, i2);
}
this.f6811e = (Messenger) intent.getExtras().get("Messenger");
this.f6812f = "https://ilk.apps.coloros.com/api/v2/";
switch ((Integer) intent.getExtras().get("MessengerFlag")) {
case 1000:
this.f6812f += "apply-unlock";
break;
case 1001:
this.f6812f += "check-approve-result";
break;
case Constants.USERCENTER_PLUGIN_ID /*{ENCODED_INT: 1002}*/:
this.f6812f += "update-client-lock-status";
break;
case 1003:
this.f6812f += "get-all-status";
break;
case 1004:
this.f6812f += "lock-client";
break;
}
this.f6810d.sendEmptyMessage(0);
return Service.START_NOT_STICKY;
}

When the message gets signaled by the system, the Handler starts a request

public final void handleMessage(Message message) {
Message message2 = new Message();
C1235c a = this.f6813a.mo6779a();
if (a == null) {
message2.what = 100;
} else {
message2.what = a.f6820a;
message2.obj = a.f6821b;
if (a.f6822c != null) {
if (a.f6822c.f6823a != null) {
message2.obj = a.f6822c.f6823a;
} else if (a.f6822c.f6824b != null) {
message2.what = 0;
message2.obj = a.f6822c.f6824b;
} else {
message2.obj = Integer.valueOf(a.f6822c.f6825c);
boolean z = true;
if (a.f6822c.f6826d != 1) {
z = false;
}
MainActivity.f6768j = z;
}
}
}
this.f6813a.f6811e.send(message2);
}

You can see that it calls mo6779a of the RequestService which does the actual request

return (C1235c) new Gson().mo5620a(m6081a(this.f6812f, Utils.m6039a(new C1234b().mo6785a(f6807a))), C1235c.class);

C1234b is this class

public final class C1234b {
@SerializedName(mo5489a = "chipId")
private String f6814a;

@SerializedName(mo5489a = "udid")
private String f6815b;

@SerializedName(mo5489a = "model")
private String f6816c;

@SerializedName(mo5489a = "otaVersion")
private String f6817d;

@SerializedName(mo5489a = "token")
private String f6818e;

@SerializedName(mo5489a = "clientLockStatus")
private int f6819f;

public final void mo6785a(Context context) {
this.f6815b = Utils.m6050d(context);
this.f6816c = SystemProperties.get("ro.product.name", BuildConfig.FLAVOR);
this.f6817d = Utils.m6047b();
Context context2 = RequestService.f6808b;
this.f6818e = AccountAgent.getToken(context2, context2.getPackageName());
this.f6814a = Utils.m6048c();
this.f6819f = 0;
}
}

m6081a failed to decompile but it takes the URI and the stringified object above and sends the request to the server like this

public static Response m6040a(Context context, String str, String str2) {
return NetonClient.execute(new Request.Builder().url(str).addHeader("model", SystemProperties.get("ro.product.name", BuildConfig.FLAVOR)).addHeader("otaVersion", m6047b()).addHeader("language", Locale.getDefault().toLanguageTag()).addHeader("key", AesEncryptUtils.m6011a(context)).post(RequestBody.create(MediaType.parse(MediaType.JSON), str2)).build());
}

which finally returns

public class C1235c {
@SerializedName(mo5489a = "code")
public int f6820a;

@SerializedName(mo5489a = "message")
public String f6821b;

@SerializedName(mo5489a = "data")
public C1236d f6822c;
}

public final class C1236d {
@SerializedName(mo5489a = "unlockCode")
private String f6823a;

@SerializedName(mo5489a = "exceptPassTime")
private String f6824b;

@SerializedName(mo5489a = "clientStatus")
private int f6825c;

@SerializedName(mo5489a = "applyStatus")
private int f6826d;
}

Long post but I had to document it somewhere. And hopefully it will be helpful to someone other than me :D