Tailscale

Use Tailscale to manage devices, users, device posture, DNS, policy files, keys, and tailnet settings.

Authentication

Enter a Tailscale API access token in API Access Token. The block sends it using Bearer authentication. Create a personal token in the Keys page of the admin console; personal tokens expire after 1–90 days and inherit the user's permissions.

An access token generated by a Tailscale OAuth client or federated identity also works. Generate that token using Tailscale's documented trust credential flow, then supply the access token to the block. The block does not exchange client secrets or refresh expired tokens. For scheduled workflows, supply a fresh access token from your credential management workflow before it expires.

Device enrollment keys (tskey-auth-) and OAuth client secrets (tskey-client-) cannot authenticate these API requests. When using scoped OAuth access tokens, grant the scopes required by the selected endpoint in the API reference. Creating a tailnet-owned auth key with OAuth also requires device tags owned by that credential.

Tailnet identifier

Tailnet-scoped operations require a Tailnet: use - for the access token's default tailnet, the tailnet ID from General Settings, or a supported legacy tailnet name. Device- and user-scoped operations use their resource IDs directly.

Device fields, filters, and keys

In advanced mode, select All device fields to include route, connectivity, SSH, and posture details. Device Filters accepts URL query syntax such as isEphemeral=true&tags=tag:server. Repeating a tag filter requires all specified tags. User lists can be filtered by relationship type and role.

List Keys returns active enrollment keys, API access tokens, and trust credentials. Use keyType and userId to identify the intended credentials before revoking them. Include All Tailnet Keys defaults to enabled; disable it to use the API's token-owner visibility rules.

Policy and network changes

Use Validate ACL to validate JSON or HuJSON policy files, or run a JSON array of ACL tests, without changing the policy. Inspect valid, message, and results, since validation errors can be returned with HTTP 200. Pass the ETag from Get ACL to Set ACL to protect against concurrent edits.

List inputs accept comma-separated values or a JSON array of strings. Use [] to clear tags, enabled routes, nameservers, or search paths. Set Split DNS replaces every split DNS entry; Update Split DNS changes only specified entries and accepts null to remove a domain. Set DNS Configuration replaces the complete DNS configuration, including resolver options and preferences. Update Tailnet Settings updates only supplied settings; do not specify both routeSelection and regionalRoutingOn.

List endpoints return a single API response and do not support pagination. Sim applies its shared response byte limit before transforming the result.

Use the block

Manage Tailscale devices, user access, posture attributes, DNS configuration, policy files, keys, subnet routes, and tailnet settings.

Actions

Tailscale List Devices

List devices in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`fields`	string	No	Device fields to return: default or all
`filters`	string	No	URL query filters for top-level device fields, e.g. isEphemeral=true&tags=tag:server

Output

Parameter	Type	Description
`devices`	array	Devices in the tailnet
↳ `addresses`	array	Tailscale IP addresses
↳ `id`	string	Resource ID
↳ `nodeId`	string	Preferred device ID
↳ `user`	string	User who registered the device
↳ `name`	string	Device MagicDNS name
↳ `hostname`	string	Device machine name
↳ `clientVersion`	string	Tailscale client version
↳ `updateAvailable`	boolean	Whether a client update is available
↳ `os`	string	Operating system
↳ `created`	string	Creation timestamp
↳ `connectedToControl`	boolean	Whether the device is connected to the control server
↳ `lastSeen`	string	Last seen timestamp; a connected device may omit it
↳ `keyExpiryDisabled`	boolean	Whether device key expiry is disabled
↳ `expires`	string	Key expiration timestamp
↳ `authorized`	boolean	Whether the device is authorized
↳ `isExternal`	boolean	Whether the device is shared from another tailnet
↳ `multipleConnections`	boolean	Whether multiple devices are using the same node key
↳ `machineKey`	string	Machine public key
↳ `nodeKey`	string	Node public key
↳ `blocksIncomingConnections`	boolean	Whether incoming connections are blocked
↳ `enabledRoutes`	array	Approved subnet routes
↳ `advertisedRoutes`	array	Advertised subnet routes
↳ `clientConnectivity`	json	Connectivity report
↳ `endpoints`	array	Client's magicsock UDP IP:port endpoints (IPv4 or IPv6)
↳ `mappingVariesByDestIP`	boolean	'true' if the host's NAT mappings vary based on the destination IP
↳ `latency`	json	Map of DERP server locations and their current latency
↳ `clientSupports`	json	Identifies features supported by the client
↳ `hairPinning`	boolean	This information is no longer tracked and will always be null
↳ `ipv6`	boolean	'true' if the device OS supports IPv6, regardless of whether IPv6 internet connectivity is available
↳ `pcp`	boolean	'true' if PCP port-mapping service exists on your router
↳ `pmp`	boolean	'true' if NAT-PMP port-mapping service exists on your router
↳ `udp`	boolean	'true' if UDP traffic is enabled on the current network; if 'false', Tailscale may be unable to make direct connections, and will rely on our DERP servers
↳ `upnp`	boolean	'true' if UPnP port-mapping service exists on your router
↳ `tags`	array	Assigned tags
↳ `tailnetLockError`	string	Tailnet lock signature error
↳ `tailnetLockKey`	string	Tailnet lock public key
↳ `sshEnabled`	boolean	Whether Tailscale SSH is enabled
↳ `postureIdentity`	json	Device posture identity
↳ `serialNumbers`	array	Serial numbers
↳ `disabled`	boolean	Disabled
↳ `postureStatus`	json	Device posture status
↳ `passing`	boolean	Reports whether the device is passing this posture
↳ `impacting`	boolean	Whether the status of this posture affects the connectivity of the device
↳ `failingAssertions`	array	List of posture assertions the device is failing
↳ `isEphemeral`	boolean	Whether the device is ephemeral
↳ `distro`	json	Operating system distribution
↳ `name`	string	Operating system distribution name
↳ `version`	string	The operating system distribution version that the device is running
↳ `codeName`	string	The operating system distribution code name that the device is running
`count`	number	Number of returned items

Tailscale Get Device

Get details of a specific device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`fields`	string	No	Device fields to return: default or all

Output

Parameter	Type	Description
`addresses`	array	Tailscale IP addresses
`id`	string	Resource ID
`nodeId`	string	Preferred device ID
`user`	string	User who registered the device
`name`	string	Device MagicDNS name
`hostname`	string	Device machine name
`clientVersion`	string	Tailscale client version
`updateAvailable`	boolean	Whether a client update is available
`os`	string	Operating system
`created`	string	Creation timestamp
`connectedToControl`	boolean	Whether the device is connected to the control server
`lastSeen`	string	Last seen timestamp; a connected device may omit it
`keyExpiryDisabled`	boolean	Whether device key expiry is disabled
`expires`	string	Key expiration timestamp
`authorized`	boolean	Whether the device is authorized
`isExternal`	boolean	Whether the device is shared from another tailnet
`multipleConnections`	boolean	Whether multiple devices are using the same node key
`machineKey`	string	Machine public key
`nodeKey`	string	Node public key
`blocksIncomingConnections`	boolean	Whether incoming connections are blocked
`enabledRoutes`	array	Approved subnet routes
`advertisedRoutes`	array	Advertised subnet routes
`clientConnectivity`	json	Connectivity report
↳ `endpoints`	array	Client's magicsock UDP IP:port endpoints (IPv4 or IPv6)
↳ `mappingVariesByDestIP`	boolean	'true' if the host's NAT mappings vary based on the destination IP
↳ `latency`	json	Map of DERP server locations and their current latency
↳ `clientSupports`	json	Identifies features supported by the client
↳ `hairPinning`	boolean	This information is no longer tracked and will always be null
↳ `ipv6`	boolean	'true' if the device OS supports IPv6, regardless of whether IPv6 internet connectivity is available
↳ `pcp`	boolean	'true' if PCP port-mapping service exists on your router
↳ `pmp`	boolean	'true' if NAT-PMP port-mapping service exists on your router
↳ `udp`	boolean	'true' if UDP traffic is enabled on the current network; if 'false', Tailscale may be unable to make direct connections, and will rely on our DERP servers
↳ `upnp`	boolean	'true' if UPnP port-mapping service exists on your router
`tags`	array	Assigned tags
`tailnetLockError`	string	Tailnet lock signature error
`tailnetLockKey`	string	Tailnet lock public key
`sshEnabled`	boolean	Whether Tailscale SSH is enabled
`postureIdentity`	json	Device posture identity
↳ `serialNumbers`	array	Serial numbers
↳ `disabled`	boolean	Disabled
`postureStatus`	json	Device posture status
↳ `passing`	boolean	Reports whether the device is passing this posture
↳ `impacting`	boolean	Whether the status of this posture affects the connectivity of the device
↳ `failingAssertions`	array	List of posture assertions the device is failing
`isEphemeral`	boolean	Whether the device is ephemeral
`distro`	json	Operating system distribution
↳ `name`	string	Operating system distribution name
↳ `version`	string	The operating system distribution version that the device is running
↳ `codeName`	string	The operating system distribution code name that the device is running

Tailscale Set Device Name

Rename a device or reset its name to the OS hostname

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`name`	string	No	New device name or FQDN; empty resets it to the OS hostname

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device
`name`	string	Submitted device name; empty resets the name

Tailscale Delete Device

Remove a device from the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device

Tailscale Authorize Device

Authorize or deauthorize a device on the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`authorized`	boolean	Yes	Whether to authorize or deauthorize the device

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device
`authorized`	boolean	Requested device authorization state

Tailscale Set Device Tags

Replace the tags assigned to a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`tags`	string	Yes	Comma-separated device tags; use [] to clear tags

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device
`tags`	array	Tags submitted for the device

Tailscale Get Device Routes

Get the advertised and approved subnet routes for a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID

Output

Parameter	Type	Description
`advertisedRoutes`	array	Subnet CIDR routes advertised by the device
`enabledRoutes`	array	Approved subnet CIDR routes

Tailscale Set Device Routes

Replace the enabled subnet routes for a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`routes`	string	Yes	Comma-separated enabled CIDR routes; use [] to disable all routes

Output

Parameter	Type	Description
`advertisedRoutes`	array	Subnet CIDR routes advertised by the device
`enabledRoutes`	array	Approved subnet CIDR routes

Tailscale Update Device Key

Enable or disable device key expiry

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`keyExpiryDisabled`	boolean	Yes	Whether to disable device key expiry

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device
`keyExpiryDisabled`	boolean	Requested device key expiry setting

Tailscale Expire Device Key

Immediately expire a device node key so the device must reauthenticate

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device

Tailscale Get Device Attributes

Get device posture attributes and their expiry times

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID

Output

Parameter	Type	Description
`attributes`	json	Map of posture attribute names to string, number, or boolean values
`expiries`	json	Map of posture attribute names to RFC 3339 expiry timestamps

Tailscale Set Device Attribute

Create or update a custom device posture attribute with an optional expiry

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`attributeKey`	string	Yes	Custom posture attribute name, prefixed with custom:
`attributeValue`	string	Yes	JSON scalar attribute value: a quoted string, integer, or boolean
`expiry`	string	No	Attribute expiry as an RFC 3339 timestamp
`comment`	string	No	Reason for setting the posture attribute, up to 200 characters

Output

Parameter	Type	Description
`attributes`	json	Map of posture attribute names to string, number, or boolean values
`expiries`	json	Map of posture attribute names to RFC 3339 expiry timestamps

Tailscale Delete Device Attribute

Remove a custom posture attribute from a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`deviceId`	string	Yes	Device nodeId (preferred) or legacy device ID
`attributeKey`	string	Yes	Custom posture attribute name, prefixed with custom:

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	ID of the affected device
`attributeKey`	string	Deleted custom posture attribute key

Tailscale List DNS Nameservers

Get the global DNS nameservers configured for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`dns`	array	DNS nameserver IP addresses

Tailscale Set DNS Nameservers

Replace the global DNS nameservers for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`dns`	string	Yes	Comma-separated DNS nameserver IP addresses; [] clears the nameservers

Output

Parameter	Type	Description
`dns`	array	DNS nameserver IP addresses
`magicDNS`	boolean	Whether MagicDNS is enabled

Tailscale Get DNS Preferences

Get the MagicDNS preference for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`magicDNS`	boolean	Whether MagicDNS is enabled

Tailscale Set DNS Preferences

Enable or disable MagicDNS for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`magicDNS`	boolean	Yes	Whether MagicDNS is enabled

Output

Parameter	Type	Description
`magicDNS`	boolean	Whether MagicDNS is enabled

Tailscale Get DNS Search Paths

Get the DNS search domains configured for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`searchPaths`	array	DNS search domain names

Tailscale Set DNS Search Paths

Replace the DNS search domains for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`searchPaths`	string	Yes	Comma-separated DNS search domains; [] clears the search paths

Output

Parameter	Type	Description
`searchPaths`	array	DNS search domain names

Tailscale Get Split DNS

Get split DNS resolvers

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`splitDns`	json	Map of domain names to DNS resolver arrays or null

Tailscale Update Split DNS

Update selected split DNS resolvers

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`splitDns`	string	Yes	JSON map of domains to nameserver arrays; null deletes a domain when updating

Output

Parameter	Type	Description
`splitDns`	json	Map of domain names to DNS resolver arrays or null

Tailscale Set Split DNS

Replace all split DNS resolvers

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`splitDns`	string	Yes	JSON map of domains to nameserver arrays; null deletes a domain when updating

Output

Parameter	Type	Description
`splitDns`	json	Map of domain names to DNS resolver arrays or null

Tailscale Get DNS Configuration

Get tailnet DNS configuration

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`dnsConfiguration`	json	Dns configuration
↳ `nameservers`	array	Global DNS resolvers to use
↳ `address`	string	IPv4 or IPv6 address of the DNS resolver
↳ `useWithExitNode`	boolean	If true, this resolver should still be used when a device is configured to use a Tailscale exit node
↳ `splitDNS`	json	Map of DNS name suffixes (domains) to lists of resolvers for Split DNS and advanced routing overlays
↳ `searchPaths`	array	Search domain paths to apply
↳ `preferences`	json	Preferences
↳ `overrideLocalDNS`	boolean	If true, resolvers in `nameservers` override the local OS DNS configuration; if false, local resolvers are used
↳ `magicDNS`	boolean	Whether MagicDNS is enabled for this tailnet

Tailscale Set DNS Configuration

Replace the full tailnet DNS configuration

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`dnsConfiguration`	string	Yes	Complete DNS configuration JSON: nameservers, splitDNS, searchPaths, preferences

Output

Parameter	Type	Description
`dnsConfiguration`	json	Dns configuration
↳ `nameservers`	array	Global DNS resolvers to use
↳ `address`	string	IPv4 or IPv6 address of the DNS resolver
↳ `useWithExitNode`	boolean	If true, this resolver should still be used when a device is configured to use a Tailscale exit node
↳ `splitDNS`	json	Map of DNS name suffixes (domains) to lists of resolvers for Split DNS and advanced routing overlays
↳ `searchPaths`	array	Search domain paths to apply
↳ `preferences`	json	Preferences
↳ `overrideLocalDNS`	boolean	If true, resolvers in `nameservers` override the local OS DNS configuration; if false, local resolvers are used
↳ `magicDNS`	boolean	Whether MagicDNS is enabled for this tailnet

Tailscale List Users

List users in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`userType`	string	No	User relationship: member (default), shared, or all
`role`	string	No	User role: owner, member, admin, it-admin, network-admin, billing-admin, or auditor

Output

Parameter	Type	Description
`users`	array	Users in the tailnet
↳ `id`	string	Resource ID
↳ `displayName`	string	User display name
↳ `loginName`	string	User login name
↳ `tailnetId`	string	Owning tailnet ID
↳ `created`	string	Creation timestamp
↳ `type`	string	User relationship: member or shared
↳ `role`	string	User role
↳ `status`	string	User status
↳ `deviceCount`	number	Number of devices owned by the user
↳ `lastSeen`	string	Last time a user device connected or the user authenticated
↳ `currentlyConnected`	boolean	Whether the user has a device connected to the control server
↳ `profilePicURL`	string	User profile picture URL
`count`	number	Number of returned items

Tailscale Get User

Get details of a specific user

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`userId`	string	Yes	Tailscale user ID

Output

Parameter	Type	Description
`id`	string	Resource ID
`displayName`	string	User display name
`loginName`	string	User login name
`tailnetId`	string	Owning tailnet ID
`created`	string	Creation timestamp
`type`	string	User relationship: member or shared
`role`	string	User role
`status`	string	User status
`deviceCount`	number	Number of devices owned by the user
`lastSeen`	string	Last time a user device connected or the user authenticated
`currentlyConnected`	boolean	Whether the user has a device connected to the control server
`profilePicURL`	string	User profile picture URL

Tailscale Set User Role

Change a tailnet user’s role

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`userId`	string	Yes	Tailscale user ID
`role`	string	Yes	User role: owner, member, admin, it-admin, network-admin, billing-admin, or auditor

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`userId`	string	ID of the affected user
`role`	string	Requested user role

Tailscale Approve User

Approve a pending user to join the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`userId`	string	Yes	Tailscale user ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`userId`	string	ID of the affected user

Tailscale Suspend User

Suspend a user’s access to the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`userId`	string	Yes	Tailscale user ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`userId`	string	ID of the affected user

Tailscale Restore User

Restore a suspended user’s access to the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`userId`	string	Yes	Tailscale user ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`userId`	string	ID of the affected user

Tailscale Delete User

Delete a user from the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`userId`	string	Yes	Tailscale user ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`userId`	string	ID of the affected user

Tailscale Create Auth Key

Create a device enrollment auth key

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`reusable`	boolean	No	Whether the auth key can register multiple devices (default false)
`ephemeral`	boolean	No	Whether devices registered with the key are ephemeral (default false)
`preauthorized`	boolean	No	Whether devices skip manual approval (default true)
`tags`	string	No	Comma-separated tags; required when creating a tailnet-owned key using OAuth
`description`	string	No	Auth key description, up to 50 alphanumeric characters, spaces, or hyphens
`expirySeconds`	number	No	Auth key lifetime in seconds (default 7776000, 90 days)

Output

Parameter	Type	Description
`id`	string	Resource ID
`keyType`	string	Credential type: auth, api, client, or federated
`expirySeconds`	number	Auth key lifetime in seconds
`created`	string	Creation timestamp
`updated`	string	Last update timestamp
`expires`	string	Key expiration timestamp
`revoked`	string	Revocation timestamp
`capabilities`	json	Device enrollment capabilities
↳ `reusable`	boolean	reusable for auth keys only; reusable auth keys can be used multiple times to register different devices
↳ `ephemeral`	boolean	ephemeral for auth keys only; ephemeral keys are used to connect and then clean up short-lived devices
↳ `preauthorized`	boolean	preauthorized for auth keys only; these are also referred to as "pre-approved" keys
↳ `tags`	array	Assigned tags
`scopes`	array	Granted API scopes
`tags`	array	Assigned tags
`description`	string	Key description
`invalid`	boolean	Whether the key is expired or revoked
`userId`	string	Creating user ID; empty for a tailnet-owned key
`audience`	string	Federated identity audience
`issuer`	string	Federated identity issuer
`subject`	string	Federated identity subject pattern
`customClaimRules`	json	Map of custom OIDC claims to matching patterns
`key`	string	Auth key secret, returned only at creation

Tailscale List Keys

List active auth keys, API access tokens, and trust credentials in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`all`	boolean	No	Include all tailnet keys (default true); false restricts keys according to the access token owner

Output

Parameter	Type	Description
`keys`	array	Keys in the tailnet
↳ `id`	string	Resource ID
↳ `keyType`	string	Credential type: auth, api, client, or federated
↳ `expirySeconds`	number	Auth key lifetime in seconds
↳ `created`	string	Creation timestamp
↳ `updated`	string	Last update timestamp
↳ `expires`	string	Key expiration timestamp
↳ `revoked`	string	Revocation timestamp
↳ `capabilities`	json	Device enrollment capabilities
↳ `reusable`	boolean	reusable for auth keys only; reusable auth keys can be used multiple times to register different devices
↳ `ephemeral`	boolean	ephemeral for auth keys only; ephemeral keys are used to connect and then clean up short-lived devices
↳ `preauthorized`	boolean	preauthorized for auth keys only; these are also referred to as "pre-approved" keys
↳ `tags`	array	Assigned tags
↳ `scopes`	array	Granted API scopes
↳ `tags`	array	Assigned tags
↳ `description`	string	Key description
↳ `invalid`	boolean	Whether the key is expired or revoked
↳ `userId`	string	Creating user ID; empty for a tailnet-owned key
↳ `audience`	string	Federated identity audience
↳ `issuer`	string	Federated identity issuer
↳ `subject`	string	Federated identity subject pattern
↳ `customClaimRules`	json	Map of custom OIDC claims to matching patterns
`count`	number	Number of returned items

Tailscale Get Auth Key

Get a key’s type, owner, scopes, expiry, and device enrollment capabilities

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`keyId`	string	Yes	Tailscale key ID

Output

Parameter	Type	Description
`id`	string	Resource ID
`keyType`	string	Credential type: auth, api, client, or federated
`expirySeconds`	number	Auth key lifetime in seconds
`created`	string	Creation timestamp
`updated`	string	Last update timestamp
`expires`	string	Key expiration timestamp
`revoked`	string	Revocation timestamp
`capabilities`	json	Device enrollment capabilities
↳ `reusable`	boolean	reusable for auth keys only; reusable auth keys can be used multiple times to register different devices
↳ `ephemeral`	boolean	ephemeral for auth keys only; ephemeral keys are used to connect and then clean up short-lived devices
↳ `preauthorized`	boolean	preauthorized for auth keys only; these are also referred to as "pre-approved" keys
↳ `tags`	array	Assigned tags
`scopes`	array	Granted API scopes
`tags`	array	Assigned tags
`description`	string	Key description
`invalid`	boolean	Whether the key is expired or revoked
`userId`	string	Creating user ID; empty for a tailnet-owned key
`audience`	string	Federated identity audience
`issuer`	string	Federated identity issuer
`subject`	string	Federated identity subject pattern
`customClaimRules`	json	Map of custom OIDC claims to matching patterns

Tailscale Delete Auth Key

Revoke an auth key, API access token, or trust credential

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`keyId`	string	Yes	Tailscale key ID

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`keyId`	string	ID of the revoked key

Tailscale Get ACL

Get the tailnet policy file

Inputs and outputs

Input

Parameter	Type	Required	Description
`details`	boolean	No	Include the original HuJSON policy and its warnings and parsing errors
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`warnings`	array	Policy warnings
`errors`	array	Policy parsing errors
`acl`	string	Tailnet policy as JSON, or the original HuJSON when diagnostics are enabled
`etag`	string	Policy ETag for conditional updates

Tailscale Validate ACL

Validate a policy file or run ACL tests without changing the tailnet policy

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`acl`	string	Yes	Policy file in JSON or HuJSON, or a JSON array of ACL tests for validation

Output

Parameter	Type	Description
`valid`	boolean	Whether validation and tests passed without warnings
`message`	string	Validation summary
`results`	array	Validation and test diagnostics
↳ `user`	string	Test identity
↳ `errors`	array	Test failures
↳ `warnings`	array	Policy warnings

Tailscale Set ACL

Replace the tailnet policy file

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`acl`	string	Yes	Complete tailnet policy file in JSON or HuJSON
`ifMatch`	string	No	ETag from Get ACL, or ts-default to replace only an untouched default policy

Output

Parameter	Type	Description
`acl`	string	Tailnet policy file as a JSON string
`etag`	string	Policy ETag for conditional updates

Tailscale Get Tailnet Settings

Get tailnet settings

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet

Output

Parameter	Type	Description
`settings`	json	Settings for a tailnet
↳ `aclsExternallyManagedOn`	boolean	Prevents users from editing policies in the admin console to avoid conflicts with external management workflows like GitOps or Terraform
↳ `aclsExternalLink`	string	Link to the external tailnet policy definition or management solution for this tailnet
↳ `adminConsoleSessionTimeoutMinutes`	number	The [admin console session timeout](/docs/account/admin-console-session-timeout) for members of this tailnet
↳ `devicesApprovalOn`	boolean	Whether [device approval](/docs/features/access-control/device-management/device-approval) is enabled for the tailnet
↳ `devicesAutoUpdatesOn`	boolean	Whether [auto updates](/docs/features/client/update#auto-updates) are enabled for devices that belong to this tailnet
↳ `devicesKeyDurationDays`	number	The [key expiry](/docs/features/access-control/key-expiry) duration for devices on this tailnet
↳ `usersApprovalOn`	boolean	Whether [user approval](/docs/features/access-control/user-approval) is enabled for this tailnet
↳ `usersRoleAllowedToJoinExternalTailnets`	string	Which user roles are allowed to [join external tailnets](/docs/features/sharing/how-to/invite-any-user)
↳ `networkFlowLoggingOn`	boolean	Whether [network flow logs](/docs/features/logging/network-flow-logs) are enabled for the tailnet
↳ `regionalRoutingOn`	boolean	Whether [regional routing](/docs/features/route-selection#regional-routing) is enabled for the tailnet
↳ `routeSelection`	string	The [route selection](/docs/features/route-selection) algorithm used by the tailnet: * `active-passive-failover` - Active-passive failover (formerly known as "Failover") * `regional-routing` - Regional routing * `regional-routing-failover` - Regional routing with in-region failover * `magicroute` - MagicRoute A PATCH request must not specify both the `regionalRoutingOn` and `routeSelection` fields
↳ `postureIdentityCollectionOn`	boolean	Whether [identity collection](/docs/features/access-control/device-management/how-to/manage-identity) is enabled for [device posture](/docs/features/device-posture) integrations for the tailnet
↳ `httpsEnabled`	boolean	Whether provisioning of [HTTPS certificates](/docs/how-to/set-up-https-certificates) is enabled for this tailnet

Tailscale Update Tailnet Settings

Update selected tailnet settings

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API access token or OAuth access token (not an auth key or OAuth client secret)
`tailnet`	string	Yes	Tailnet ID, legacy name, or "-" for the token’s default tailnet
`settings`	string	Yes	JSON object of settings to update; omitted settings remain unchanged

Output

Parameter	Type	Description
`settings`	json	Settings for a tailnet
↳ `aclsExternallyManagedOn`	boolean	Prevents users from editing policies in the admin console to avoid conflicts with external management workflows like GitOps or Terraform
↳ `aclsExternalLink`	string	Link to the external tailnet policy definition or management solution for this tailnet
↳ `adminConsoleSessionTimeoutMinutes`	number	The [admin console session timeout](/docs/account/admin-console-session-timeout) for members of this tailnet
↳ `devicesApprovalOn`	boolean	Whether [device approval](/docs/features/access-control/device-management/device-approval) is enabled for the tailnet
↳ `devicesAutoUpdatesOn`	boolean	Whether [auto updates](/docs/features/client/update#auto-updates) are enabled for devices that belong to this tailnet
↳ `devicesKeyDurationDays`	number	The [key expiry](/docs/features/access-control/key-expiry) duration for devices on this tailnet
↳ `usersApprovalOn`	boolean	Whether [user approval](/docs/features/access-control/user-approval) is enabled for this tailnet
↳ `usersRoleAllowedToJoinExternalTailnets`	string	Which user roles are allowed to [join external tailnets](/docs/features/sharing/how-to/invite-any-user)
↳ `networkFlowLoggingOn`	boolean	Whether [network flow logs](/docs/features/logging/network-flow-logs) are enabled for the tailnet
↳ `regionalRoutingOn`	boolean	Whether [regional routing](/docs/features/route-selection#regional-routing) is enabled for the tailnet
↳ `routeSelection`	string	The [route selection](/docs/features/route-selection) algorithm used by the tailnet: * `active-passive-failover` - Active-passive failover (formerly known as "Failover") * `regional-routing` - Regional routing * `regional-routing-failover` - Regional routing with in-region failover * `magicroute` - MagicRoute A PATCH request must not specify both the `regionalRoutingOn` and `routeSelection` fields
↳ `postureIdentityCollectionOn`	boolean	Whether [identity collection](/docs/features/access-control/device-management/how-to/manage-identity) is enabled for [device posture](/docs/features/device-posture) integrations for the tailnet
↳ `httpsEnabled`	boolean	Whether provisioning of [HTTPS certificates](/docs/how-to/set-up-https-certificates) is enabled for this tailnet