I am assuming that to create a wizard (or Action as it looks like it is called in the API) I have to map the condition of the remote to an effect on the light (such as device/42015/OnOff/toggle)
Yes that is correct.
It makes me wonder if I have to authenticate somehow to be able to see the detailed capabilities of the devices?
No, authentication API’s are not yet implemented in the latest release. So what you are doing is correct.
I am also showing no capabilities for my GE lights, which I can control from the iSmartenit App just fine
After a Zigbee device joins the network successfully, the ZBPServer will try to request detailed information about the device in order to build the capabilities. If the components are empty, then its possible that the device failed to respond to some messages.
Can you try to rediscover using following:
curl -X POST "http://cush:50334/devices/42015/capabilities/discover"
Let me know how it goes.