Tailscale

Retrieve a single device's details (GET /device/{deviceId}). Optional 'fields' controls detail level.

Remove a device from the tailnet (DELETE /device/{deviceId}).

Authorize or de-authorize a device on a tailnet that requires device approval (POST /device/{deviceId}/authorized).

Replace a device's ACL tags (POST /device/{deviceId}/tags). Tags must be defined in the tailnet policy file.

Update key-management attributes for a device, e.g. disable key expiry (POST /device/{deviceId}/key).

Set the Tailscale IPv4 address for a device (POST /device/{deviceId}/ip).

Immediately expire a device's node key, forcing re-authentication (POST /device/{deviceId}/expire).

List a device's advertised and enabled subnet routes (GET /device/{deviceId}/routes).

Set the enabled subnet routes for a device (POST /device/{deviceId}/routes).

Retrieve the custom posture attributes set on a device (GET /device/{deviceId}/attributes).

Set a single custom posture attribute on a device (POST /device/{deviceId}/attributes/{attributeKey}).

Remove a custom posture attribute from a device (DELETE /device/{deviceId}/attributes/{attributeKey}).

List share invites for a device (GET /device/{deviceId}/device-invites).

Create share invites for a device (POST /device/{deviceId}/device-invites).

Get the tailnet's global DNS nameservers (GET /tailnet/{tailnet}/dns/nameservers).

Replace the tailnet's global DNS nameservers (POST /tailnet/{tailnet}/dns/nameservers).

Get the tailnet's DNS preferences, including whether MagicDNS is enabled (GET /tailnet/{tailnet}/dns/preferences).

Set the tailnet's DNS preferences, e.g. enable or disable MagicDNS (POST /tailnet/{tailnet}/dns/preferences).

Get the tailnet's DNS search paths (GET /tailnet/{tailnet}/dns/searchpaths).

Replace the tailnet's DNS search paths (POST /tailnet/{tailnet}/dns/searchpaths).

Get the tailnet's split-DNS configuration (GET /tailnet/{tailnet}/dns/split-dns): per-domain nameserver mappings.

Partially update the tailnet's split-DNS mappings (PATCH /tailnet/{tailnet}/dns/split-dns). Only the provided domains are changed.

Replace the tailnet's entire split-DNS configuration (PUT /tailnet/{tailnet}/dns/split-dns).

List the users of the tailnet (GET /tailnet/{tailnet}/users). Optional type and role filters.

Retrieve a single user's details (GET /users/{userId}).

Approve a user who is awaiting approval to join the tailnet (POST /users/{userId}/approve).

Suspend a user, blocking their access to the tailnet (POST /users/{userId}/suspend).

Restore a previously suspended user (POST /users/{userId}/restore).

Remove a user from the tailnet (POST /users/{userId}/delete).

Change a user's role in the tailnet (POST /users/{userId}/role).

List the webhook endpoints configured for the tailnet (GET /tailnet/{tailnet}/webhooks).

Create a webhook endpoint for the tailnet (POST /tailnet/{tailnet}/webhooks). Choose the destination URL, provider type, and event subscriptions. Note: Tailscale's delivery signature is not natively verifiable by Zervanor — use the device-list polling trigger for reliable change notifications.

Retrieve a webhook endpoint by id (GET /webhooks/{endpointId}).

Update a webhook endpoint's event subscriptions (PATCH /webhooks/{endpointId}).

Delete a webhook endpoint (DELETE /webhooks/{endpointId}).

Queue a test event to a webhook endpoint (POST /webhooks/{endpointId}/test).

Rotate the signing secret of a webhook endpoint (POST /webhooks/{endpointId}/rotate).

List the tailnet's pending user invites (GET /tailnet/{tailnet}/user-invites).

Create one or more user invites for the tailnet (POST /tailnet/{tailnet}/user-invites).

Retrieve a single user invite by id (GET /user-invites/{userInviteId}).

Resend a user invite email (POST /user-invites/{userInviteId}/resend).

Delete (revoke) a user invite (DELETE /user-invites/{userInviteId}).

Retrieve the tailnet's ACL policy file (GET /tailnet/{tailnet}/acl). Returns HuJSON or JSON depending on the Accept header.

Replace the tailnet's ACL policy file (POST /tailnet/{tailnet}/acl). Body is the full policy (ACLs, groups, tagOwners, autoApprovers, etc.).

Preview which devices a proposed ACL policy would let a user or IP reach (POST /tailnet/{tailnet}/acl/preview). Does not apply the policy.

Validate and test a proposed ACL policy file without applying it (POST /tailnet/{tailnet}/acl/validate). Returns errors and test results.

List the auth keys and API access tokens for the tailnet (GET /tailnet/{tailnet}/keys).

Create a new auth key (POST /tailnet/{tailnet}/keys). Set capabilities (reusable, ephemeral, preauthorized, tags), expiry, and description.

Retrieve metadata for a single auth key or API access token (GET /tailnet/{tailnet}/keys/{keyId}).

Delete an auth key or API access token, invalidating it (DELETE /tailnet/{tailnet}/keys/{keyId}).

Retrieve a single device invite by id (GET /device-invites/{deviceInviteId}).

Resend a device invite email (POST /device-invites/{deviceInviteId}/resend).

Delete (revoke) a device invite (DELETE /device-invites/{deviceInviteId}).

Get the tailnet's account, support, and security contact preferences (GET /tailnet/{tailnet}/contacts).

Update one of the tailnet's contact types (PATCH /tailnet/{tailnet}/contacts/{contactType}). Changing the email triggers a verification message.

Get the tailnet's settings, e.g. device-approval and key-duration policies (GET /tailnet/{tailnet}/settings).

Update the tailnet's settings (PATCH /tailnet/{tailnet}/settings), e.g. toggle device approval or set the maximum key duration.

List every device in the tailnet (GET /tailnet/{tailnet}/devices). Optional 'fields' controls the level of detail. Identity + connectivity probe, and the polling source for device-lifecycle change notifications.