I can point in a direction, not sure if its right.
this describes sending a raw z-wave command:
luup.call_action("urn:micasaverde-com:serviceId:ZWaveNetwork1", "SendData", {Node=15, Data="x70 4 29 1 3"}, 1)
x70 is COMMAND_CLASS_CONFIGURE. 4 is SET, 29 is the parameter #, 1 is the size of the value, I think, and 3 is the value.
So, GET will probably be similar. Checking here I can see that 5 is CONFIGURATION_GET and 8 is CONFIGURATION_BULK_GET.
The format of the request is here around p 156.
Looks like GET is simpler, so change the 4 to 5 and the parameter from 29 to 3 (Default PIR time), and 15 to 27 which is my sensor.
luup.call_action("urn:micasaverde-com:serviceId:ZWaveNetwork1", "SendData", {Node=27, Data="x70 5 3"}, 1)
Then turning on verbose mode and tailing the log for z-wave data …
tail -f /var/log/cmh/LuaUPnP.log | grep '^01\|^41\|^42\|^24'
I’m now looking for the response frame, which is a CONFIGURATION_REPORT which is 0x06.
So I should see some data come back that starts with 0x70 0x06.
Oops. I don’t.
Anyway, I have to make dinner, but maybe this is enough to start fiddling?