I don't think you've missed something.
For what I've seen so far, all the .cgi URl that can be found are registered in LibIPCamera.c (using httpRegisterEmbedFunEx). If you take the API specification v1.3, you can deduce that all the commands registered at the URL Rev.cgi (moving the robot, going back home) are missing from this file.
Those functionalities are registered in libhttp.a (in httpdStartEx3).
The source code of libhttp.a isn't provided because it contains information about libNS.a which is not opensource. (At the same time, it uses a modified version of the boa web server http://www.boa.org/ which is under GPL, so I think its sources should be provided, Host\libhttp\Inc\boa.h)
So i think you have to reverse engineering those libraries to have access to the most interesting part of the Rovio.
You can already have a clue on what are the names of the functions inside the libraries using the static call graph Host\LibCamera\Samples\CameraTest\Bin\CameraTest.htm (libNS.a contains er_ns_nav.o and libhttp.a a lot of objects, look at the headers)
If you find an easier solution, tell me ;)
Thanks, if I can find something interesting, I will post it here :)