Can I use Tailscale as a CLI?

Yes. KosmoKrator exposes a Tailscale CLI through kosmo integrations:call and the provider shortcut command. Commands can return JSON for scripts, CI, and coding agents.

Can I expose Tailscale through MCP?

Yes. The KosmoKrator MCP gateway can expose selected Tailscale tools to clients such as Claude Code, Cursor, Codex, and other MCP-compatible tools.

Where are Tailscale credentials stored?

Tailscale credentials are configured in KosmoKrator's local integration settings and reused by CLI, Lua, and MCP gateway surfaces.

Can I deny write access for Tailscale MCP tools?

Yes. Start the gateway with --write=deny for read-only clients, or use ask/allow only for trusted workspaces.

productivity

Tailscale Lua API for KosmoKrator Agents

Agent-facing Lua documentation and function reference for the Tailscale KosmoKrator integration.

Lua Namespace

Agents call this integration through app.integrations.tailscale.*. Use lua_read_doc("integrations.tailscale") inside KosmoKrator to discover the same reference at runtime.

Call Lua from the Headless CLI

Use kosmo integrations:lua when a shell script, CI job, cron job, or another coding CLI should run a deterministic Tailscale workflow without starting an interactive agent session.

Inline Lua call

kosmo integrations:lua --eval 'dump(app.integrations.tailscale.list_tailnet_devices({}))' --json

Read Lua docs headlessly

kosmo integrations:lua --eval 'print(docs.read("tailscale"))' --json
kosmo integrations:lua --eval 'print(docs.read("tailscale.list_tailnet_devices"))' --json

Workflow file

Put repeatable logic in a Lua file, then execute it with JSON output for the calling process.

workflow.lua

local tailscale = app.integrations.tailscale
local result = tailscale.list_tailnet_devices({})

dump(result)

Run the workflow

kosmo integrations:lua workflow.lua --json
kosmo integrations:lua workflow.lua --force --json

Namespace note. integrations:lua exposes app.integrations.tailscale, app.mcp.*, docs.*, json.*, and regex.*. Use app.integrations.tailscale.default.* or app.integrations.tailscale.work.* when you configured named credential accounts.

MCP-only Lua

If the script only needs configured MCP servers and does not need Tailscale, use the narrower mcp:lua command.

MCP Lua command

# Use mcp:lua for MCP-only scripts; use integrations:lua for this integration namespace.
kosmo mcp:lua --eval 'dump(mcp.servers())' --json

Agent-Facing Lua Docs

This is the rendered version of the full Lua documentation exposed to agents when they inspect the integration namespace.

Tailscale Lua API

Generated from Tailscale’s official OpenAPI 3.1 document served by https://api.tailscale.com/api/v2. The namespace is app.integrations.tailscale.

This package exposes 85 endpoint-specific tools: 32 read tools and 53 write tools. Configure api_token with a Tailscale API access token.

Usage

local devices = app.integrations.tailscale.list_tailnet_devices({
  tailnet = '-',
  fields = 'all'
})

local key = app.integrations.tailscale.create_key({
  tailnet = '-',
  body = { capabilities = { devices = { create = { reusable = false } } } }
})

Request Bodies

Tools that create, update, patch, or delete resources may accept a body table. Path and query arguments use snake_case names and are mapped back to the official parameter names.

Example Tools

| tailscale_list_tailnet_devices | read | GET /tailnet/{tailnet}/devices | | tailscale_batch_update_custom_device_posture_attributes | write | PATCH /tailnet/{tailnet}/device-attributes | | tailscale_get_device | read | GET /device/{deviceId} | | tailscale_delete_device | write | DELETE /device/{deviceId} | | tailscale_expire_device_key | write | POST /device/{deviceId}/expire | | tailscale_list_device_routes | read | GET /device/{deviceId}/routes | | tailscale_set_device_routes | write | POST /device/{deviceId}/routes | | tailscale_authorize_device | write | POST /device/{deviceId}/authorized | | tailscale_set_device_name | write | POST /device/{deviceId}/name | | tailscale_set_device_tags | write | POST /device/{deviceId}/tags | | tailscale_update_device_key | write | POST /device/{deviceId}/key | | tailscale_set_device_ip | write | POST /device/{deviceId}/ip | | tailscale_get_device_posture_attributes | read | GET /device/{deviceId}/attributes | | tailscale_set_custom_device_posture_attributes | write | POST /device/{deviceId}/attributes/{attributeKey} | | tailscale_delete_custom_device_posture_attributes | write | DELETE /device/{deviceId}/attributes/{attributeKey} | | tailscale_list_device_invites | read | GET /device/{deviceId}/device-invites | | tailscale_create_device_invites | write | POST /device/{deviceId}/device-invites | | tailscale_list_user_invites | read | GET /tailnet/{tailnet}/user-invites | | tailscale_create_user_invites | write | POST /tailnet/{tailnet}/user-invites | | tailscale_get_user_invite | read | GET /user-invites/{userInviteId} | | tailscale_delete_user_invite | write | DELETE /user-invites/{userInviteId} | | tailscale_resend_user_invite | write | POST /user-invites/{userInviteId}/resend | | tailscale_get_device_invite | read | GET /device-invites/{deviceInviteId} | | tailscale_delete_device_invite | write | DELETE /device-invites/{deviceInviteId} | | tailscale_resend_device_invite | write | POST /device-invites/{deviceInviteId}/resend | | tailscale_accept_device_invite | write | POST /device-invites/-/accept | | tailscale_list_configuration_audit_logs | read | GET /tailnet/{tailnet}/logging/configuration | | tailscale_list_network_flow_logs | read | GET /tailnet/{tailnet}/logging/network | | tailscale_get_log_streaming_status | read | GET /tailnet/{tailnet}/logging/{logType}/stream/status | | tailscale_get_log_streaming_configuration | read | GET /tailnet/{tailnet}/logging/{logType}/stream | | tailscale_set_log_streaming_configuration | write | PUT /tailnet/{tailnet}/logging/{logType}/stream | | tailscale_disable_log_streaming | write | DELETE /tailnet/{tailnet}/logging/{logType}/stream |

Notes

The base URL defaults to https://api.tailscale.com/api/v2.
Tailscale allows - as the tailnet path value for the default tailnet.
Authentication uses HTTP Basic auth with the API token as username and an empty password.
Returned data is the parsed JSON response from Tailscale.

Raw agent markdown

# Tailscale Lua API

Generated from Tailscale's official OpenAPI 3.1 document served by `https://api.tailscale.com/api/v2`. The namespace is `app.integrations.tailscale`.

This package exposes 85 endpoint-specific tools: 32 read tools and 53 write tools. Configure `api_token` with a Tailscale API access token.

## Usage

```lua
local devices = app.integrations.tailscale.list_tailnet_devices({
  tailnet = '-',
  fields = 'all'
})

local key = app.integrations.tailscale.create_key({
  tailnet = '-',
  body = { capabilities = { devices = { create = { reusable = false } } } }
})
```

## Request Bodies

Tools that create, update, patch, or delete resources may accept a `body` table. Path and query arguments use snake_case names and are mapped back to the official parameter names.

## Example Tools

| `tailscale_list_tailnet_devices` | read | GET `/tailnet/{tailnet}/devices` |
| `tailscale_batch_update_custom_device_posture_attributes` | write | PATCH `/tailnet/{tailnet}/device-attributes` |
| `tailscale_get_device` | read | GET `/device/{deviceId}` |
| `tailscale_delete_device` | write | DELETE `/device/{deviceId}` |
| `tailscale_expire_device_key` | write | POST `/device/{deviceId}/expire` |
| `tailscale_list_device_routes` | read | GET `/device/{deviceId}/routes` |
| `tailscale_set_device_routes` | write | POST `/device/{deviceId}/routes` |
| `tailscale_authorize_device` | write | POST `/device/{deviceId}/authorized` |
| `tailscale_set_device_name` | write | POST `/device/{deviceId}/name` |
| `tailscale_set_device_tags` | write | POST `/device/{deviceId}/tags` |
| `tailscale_update_device_key` | write | POST `/device/{deviceId}/key` |
| `tailscale_set_device_ip` | write | POST `/device/{deviceId}/ip` |
| `tailscale_get_device_posture_attributes` | read | GET `/device/{deviceId}/attributes` |
| `tailscale_set_custom_device_posture_attributes` | write | POST `/device/{deviceId}/attributes/{attributeKey}` |
| `tailscale_delete_custom_device_posture_attributes` | write | DELETE `/device/{deviceId}/attributes/{attributeKey}` |
| `tailscale_list_device_invites` | read | GET `/device/{deviceId}/device-invites` |
| `tailscale_create_device_invites` | write | POST `/device/{deviceId}/device-invites` |
| `tailscale_list_user_invites` | read | GET `/tailnet/{tailnet}/user-invites` |
| `tailscale_create_user_invites` | write | POST `/tailnet/{tailnet}/user-invites` |
| `tailscale_get_user_invite` | read | GET `/user-invites/{userInviteId}` |
| `tailscale_delete_user_invite` | write | DELETE `/user-invites/{userInviteId}` |
| `tailscale_resend_user_invite` | write | POST `/user-invites/{userInviteId}/resend` |
| `tailscale_get_device_invite` | read | GET `/device-invites/{deviceInviteId}` |
| `tailscale_delete_device_invite` | write | DELETE `/device-invites/{deviceInviteId}` |
| `tailscale_resend_device_invite` | write | POST `/device-invites/{deviceInviteId}/resend` |
| `tailscale_accept_device_invite` | write | POST `/device-invites/-/accept` |
| `tailscale_list_configuration_audit_logs` | read | GET `/tailnet/{tailnet}/logging/configuration` |
| `tailscale_list_network_flow_logs` | read | GET `/tailnet/{tailnet}/logging/network` |
| `tailscale_get_log_streaming_status` | read | GET `/tailnet/{tailnet}/logging/{logType}/stream/status` |
| `tailscale_get_log_streaming_configuration` | read | GET `/tailnet/{tailnet}/logging/{logType}/stream` |
| `tailscale_set_log_streaming_configuration` | write | PUT `/tailnet/{tailnet}/logging/{logType}/stream` |
| `tailscale_disable_log_streaming` | write | DELETE `/tailnet/{tailnet}/logging/{logType}/stream` |


## Notes

- The base URL defaults to `https://api.tailscale.com/api/v2`.
- Tailscale allows `-` as the `tailnet` path value for the default tailnet.
- Authentication uses HTTP Basic auth with the API token as username and an empty password.
- Returned data is the parsed JSON response from Tailscale.

Metadata-derived Lua example

local result = app.integrations.tailscale.list_tailnet_devices({})
print(result)

Functions

list_tailnet_devices Read

List tailnet devices Official Tailscale endpoint: GET /tailnet/{tailnet}/devices Lists the devices in a tailnet. OAuth Scope: `devices:core:read`.

Lua path: app.integrations.tailscale.list_tailnet_devices
Full name: tailscale.tailscale_list_tailnet_devices

Parameter	Type	Required	Description
No parameters.

batch_update_custom_device_posture_attributes Write

Batch update custom device posture attributes Official Tailscale endpoint: PATCH /tailnet/{tailnet}/device-attributes Batch updates posture attributes across devices in a tailnet. This endpoint uses [JSON Merge Patch](https://datatracker.ie

Lua path: app.integrations.tailscale.batch_update_custom_device_posture_attributes
Full name: tailscale.tailscale_batch_update_custom_device_posture_attributes

Parameter	Type	Required	Description
No parameters.

get_device Read

Get a device Official Tailscale endpoint: GET /device/{deviceId} Retrieve the details for the specified device. OAuth Scope: `devices:core:read`.

Lua path: app.integrations.tailscale.get_device
Full name: tailscale.tailscale_get_device

Parameter	Type	Required	Description
No parameters.

delete_device Write

Delete a device Official Tailscale endpoint: DELETE /device/{deviceId} Deletes the device from its tailnet. The device must belong to the requesting user's tailnet. Deleting devices shared with the tailnet is not supported. OAuth Scope: `de

Lua path: app.integrations.tailscale.delete_device
Full name: tailscale.tailscale_delete_device

Parameter	Type	Required	Description
No parameters.

expire_device_key Write

Expire a device's key Official Tailscale endpoint: POST /device/{deviceId}/expire Mark a device's node key as expired. This will require the device to re-authenticate in order to connect to the tailnet. The device must belong to the request

Lua path: app.integrations.tailscale.expire_device_key
Full name: tailscale.tailscale_expire_device_key

Parameter	Type	Required	Description
No parameters.

list_device_routes Read

List device routes Official Tailscale endpoint: GET /device/{deviceId}/routes Retrieve the list of subnet routes that a device is advertising, as well as those that are enabled for it. Routes must be both advertised and enabled for a device

Lua path: app.integrations.tailscale.list_device_routes
Full name: tailscale.tailscale_list_device_routes

Parameter	Type	Required	Description
No parameters.

set_device_routes Write

Set device routes Official Tailscale endpoint: POST /device/{deviceId}/routes Set a device's enabled subnet routes by replacing the existing list of subnet routes with the supplied parameters. [Advertised routes](/kb/1019/subnets#advertise-

Lua path: app.integrations.tailscale.set_device_routes
Full name: tailscale.tailscale_set_device_routes

Parameter	Type	Required	Description
No parameters.

authorize_device Write

Authorize device Official Tailscale endpoint: POST /device/{deviceId}/authorized This call marks a device as authorized or revokes its authorization for tailnets where device authorization is required, according to the authorized field in t

Lua path: app.integrations.tailscale.authorize_device
Full name: tailscale.tailscale_authorize_device

Parameter	Type	Required	Description
No parameters.

set_device_name Write

Set device name Official Tailscale endpoint: POST /device/{deviceId}/name When a device is added to a tailnet, its Tailscale [device name](https://tailscale.com/kb/1098/machine-names) (also sometimes referred to as machine name) is generate

Lua path: app.integrations.tailscale.set_device_name
Full name: tailscale.tailscale_set_device_name

Parameter	Type	Required	Description
No parameters.

set_device_tags Write

Set device tags Official Tailscale endpoint: POST /device/{deviceId}/tags Tags let you assign an identity to a device that is separate from human users, and use that identity as part of an ACL to restrict access. Tags are similar to role ac

Lua path: app.integrations.tailscale.set_device_tags
Full name: tailscale.tailscale_set_device_tags

Parameter	Type	Required	Description
No parameters.

update_device_key Write

Update device key Official Tailscale endpoint: POST /device/{deviceId}/key When a device is added to a tailnet, its key expiry is set according to the tailnet's key expiry setting. If the key is not refreshed and expires, the device can no

Lua path: app.integrations.tailscale.update_device_key
Full name: tailscale.tailscale_update_device_key

Parameter	Type	Required	Description
No parameters.

set_device_ipv4_address Write

Set device IPv4 address Official Tailscale endpoint: POST /device/{deviceId}/ip When a device is added to a tailnet, its Tailscale IPv4 address is set at random either from the CGNAT range, or a subset of the CGNAT range specified by an [ip

Lua path: app.integrations.tailscale.set_device_ipv4_address
Full name: tailscale.tailscale_set_device_ip

Parameter	Type	Required	Description
No parameters.

get_device_posture_attributes Read

Get device posture attributes Official Tailscale endpoint: GET /device/{deviceId}/attributes Retrieve all posture attributes for the specified device. This returns a JSON object of all the key-value pairs of posture attributes for the devic

Lua path: app.integrations.tailscale.get_device_posture_attributes
Full name: tailscale.tailscale_get_device_posture_attributes

Parameter	Type	Required	Description
No parameters.

set_custom_device_posture_attributes Write

Set custom device posture attributes Official Tailscale endpoint: POST /device/{deviceId}/attributes/{attributeKey} Create or update a custom posture attribute on the specified device. User-managed attributes must be in the custom namespace

Lua path: app.integrations.tailscale.set_custom_device_posture_attributes
Full name: tailscale.tailscale_set_custom_device_posture_attributes

Parameter	Type	Required	Description
No parameters.

delete_custom_device_posture_attributes Write

Delete custom device posture attributes Official Tailscale endpoint: DELETE /device/{deviceId}/attributes/{attributeKey} Delete a posture attribute from the specified device. This is only applicable to user-managed posture attributes in the

Lua path: app.integrations.tailscale.delete_custom_device_posture_attributes
Full name: tailscale.tailscale_delete_custom_device_posture_attributes

Parameter	Type	Required	Description
No parameters.

list_device_invites Read

List device invites Official Tailscale endpoint: GET /device/{deviceId}/device-invites List all share invites for a device. OAuth Scope: `device_invites:read`.

Lua path: app.integrations.tailscale.list_device_invites
Full name: tailscale.tailscale_list_device_invites

Parameter	Type	Required	Description
No parameters.

create_device_invites Write

Create device invites Official Tailscale endpoint: POST /device/{deviceId}/device-invites Create new share invites for a device. Note that device invites cannot be created using an API access token generated from an OAuth client as the shar

Lua path: app.integrations.tailscale.create_device_invites
Full name: tailscale.tailscale_create_device_invites

Parameter	Type	Required	Description
No parameters.

list_user_invites Read

List user invites Official Tailscale endpoint: GET /tailnet/{tailnet}/user-invites List all open (not yet accepted) user invites to the tailnet.

Lua path: app.integrations.tailscale.list_user_invites
Full name: tailscale.tailscale_list_user_invites

Parameter	Type	Required	Description
No parameters.

create_user_invites Write

Create user invites Official Tailscale endpoint: POST /tailnet/{tailnet}/user-invites Create, and optionally email out, new user invites to join the tailnet. > ⓘ Only permitted for user-owned keys, because invites require an inviting user

Lua path: app.integrations.tailscale.create_user_invites
Full name: tailscale.tailscale_create_user_invites

Parameter	Type	Required	Description
No parameters.

get_user_invite Read

Get a user invite Official Tailscale endpoint: GET /user-invites/{userInviteId} Retrieve a specific user invite.

Lua path: app.integrations.tailscale.get_user_invite
Full name: tailscale.tailscale_get_user_invite

Parameter	Type	Required	Description
No parameters.

delete_user_invite Write

Delete a user invite Official Tailscale endpoint: DELETE /user-invites/{userInviteId} Deletes a specific user invite. > ⓘ Only permitted for user-owned keys, because invites require an inviting user.

Lua path: app.integrations.tailscale.delete_user_invite
Full name: tailscale.tailscale_delete_user_invite

Parameter	Type	Required	Description
No parameters.

resend_user_invite Write

Resend a user invite Official Tailscale endpoint: POST /user-invites/{userInviteId}/resend Resend a user invite by email. You can only use this if the specified invite was originally created with an email specified. Refer to [creating user

Lua path: app.integrations.tailscale.resend_user_invite
Full name: tailscale.tailscale_resend_user_invite

Parameter	Type	Required	Description
No parameters.

get_device_invite Read

Get a device invite Official Tailscale endpoint: GET /device-invites/{deviceInviteId} Retrieve a specific device invite. OAuth Scope: `device_invites:read`.

Lua path: app.integrations.tailscale.get_device_invite
Full name: tailscale.tailscale_get_device_invite

Parameter	Type	Required	Description
No parameters.

delete_device_invite Write

Delete a device invite Official Tailscale endpoint: DELETE /device-invites/{deviceInviteId} Delete a specific device invite. OAuth Scope: `device_invites`.

Lua path: app.integrations.tailscale.delete_device_invite
Full name: tailscale.tailscale_delete_device_invite

Parameter	Type	Required	Description
No parameters.

resend_device_invite Write

Resend a device invite Official Tailscale endpoint: POST /device-invites/{deviceInviteId}/resend Resend a device invite by email. You can only use this if the specified invite was originally created with an email specified. Refer to [creati

Lua path: app.integrations.tailscale.resend_device_invite
Full name: tailscale.tailscale_resend_device_invite

Parameter	Type	Required	Description
No parameters.

accept_device_invite Write

Accept a device invite Official Tailscale endpoint: POST /device-invites/-/accept Accepts the invitation to share a device into the requesting user's tailnet. Note that device invites cannot be accepted using an API access token generated f

Lua path: app.integrations.tailscale.accept_device_invite
Full name: tailscale.tailscale_accept_device_invite

Parameter	Type	Required	Description
No parameters.

list_configuration_audit_logs Read

List configuration audit logs Official Tailscale endpoint: GET /tailnet/{tailnet}/logging/configuration List all configuration audit logs for a tailnet. OAuth Scope: `logs:configuration:read`.

Lua path: app.integrations.tailscale.list_configuration_audit_logs
Full name: tailscale.tailscale_list_configuration_audit_logs

Parameter	Type	Required	Description
No parameters.

list_network_flow_logs Read

List network flow logs Official Tailscale endpoint: GET /tailnet/{tailnet}/logging/network List all network flow logs for a tailnet. OAuth Scope: `logs:network:read`.

Lua path: app.integrations.tailscale.list_network_flow_logs
Full name: tailscale.tailscale_list_network_flow_logs

Parameter	Type	Required	Description
No parameters.

get_log_streaming_status Read

Get log streaming status Official Tailscale endpoint: GET /tailnet/{tailnet}/logging/{logType}/stream/status Retrieve the log streaming status for the provided log type. OAuth Scope: `log_streaming:read`.

Lua path: app.integrations.tailscale.get_log_streaming_status
Full name: tailscale.tailscale_get_log_streaming_status

Parameter	Type	Required	Description
No parameters.

get_log_streaming_configuration Read

Get log streaming configuration Official Tailscale endpoint: GET /tailnet/{tailnet}/logging/{logType}/stream Retrieve the log streaming configuration for the provided log type. OAuth Scope: `log_streaming:read`.

Lua path: app.integrations.tailscale.get_log_streaming_configuration
Full name: tailscale.tailscale_get_log_streaming_configuration

Parameter	Type	Required	Description
No parameters.

set_log_streaming_configuration Write

Set log streaming configuration Official Tailscale endpoint: PUT /tailnet/{tailnet}/logging/{logType}/stream Set the log streaming configuration for the provided log type. OAuth Scope: `log_streaming`. `device_invites` and `policy_file` are

Lua path: app.integrations.tailscale.set_log_streaming_configuration
Full name: tailscale.tailscale_set_log_streaming_configuration

Parameter	Type	Required	Description
No parameters.

disable_log_streaming Write

Disable log streaming Official Tailscale endpoint: DELETE /tailnet/{tailnet}/logging/{logType}/stream Delete the log streaming configuration for the provided log type. OAuth Scope: `log_streaming`.

Lua path: app.integrations.tailscale.disable_log_streaming
Full name: tailscale.tailscale_disable_log_streaming

Parameter	Type	Required	Description
No parameters.

create_or_get_aws_external_id Write

Create or get AWS external id Official Tailscale endpoint: POST /tailnet/{tailnet}/aws-external-id Get an AWS external id to use for streaming tailnet logs to S3 using role-based authentication, creating a new one for this tailnet when nece

Lua path: app.integrations.tailscale.create_or_get_aws_external_id
Full name: tailscale.tailscale_get_aws_external_id

Parameter	Type	Required	Description
No parameters.

validate_external_id_integration_with_iam_role_trust_policy Write

Validate external ID integration with IAM role trust policy Official Tailscale endpoint: POST /tailnet/{tailnet}/aws-external-id/{id}/validate-aws-trust-policy Validate that Tailscale can assume your IAM role with (and only with) this exter

Lua path: app.integrations.tailscale.validate_external_id_integration_with_iam_role_trust_policy
Full name: tailscale.tailscale_validate_aws_external_id

Parameter	Type	Required	Description
No parameters.

list_dns_nameservers Read

List DNS nameservers Official Tailscale endpoint: GET /tailnet/{tailnet}/dns/nameservers Lists the global DNS nameservers for a tailnet.

Lua path: app.integrations.tailscale.list_dns_nameservers
Full name: tailscale.tailscale_list_dns_nameservers

Parameter	Type	Required	Description
No parameters.

set_dns_nameservers Write

Set DNS nameservers Official Tailscale endpoint: POST /tailnet/{tailnet}/dns/nameservers Replaces the list of global DNS nameservers for the given tailnet with the list supplied in the request. Note that changing the list of DNS nameservers

Lua path: app.integrations.tailscale.set_dns_nameservers
Full name: tailscale.tailscale_set_dns_nameservers

Parameter	Type	Required	Description
No parameters.

get_dns_preferences Read

Get DNS preferences Official Tailscale endpoint: GET /tailnet/{tailnet}/dns/preferences Retrieves the DNS preferences that are currently set for the given tailnet.

Lua path: app.integrations.tailscale.get_dns_preferences
Full name: tailscale.tailscale_get_dns_preferences

Parameter	Type	Required	Description
No parameters.

set_dns_preferences Write

Set DNS preferences Official Tailscale endpoint: POST /tailnet/{tailnet}/dns/preferences Set the DNS preferences for a tailnet; specifically, the MagicDNS setting. Note that MagicDNS is dependent on DNS servers. Learn about [MagicDNS](https

Lua path: app.integrations.tailscale.set_dns_preferences
Full name: tailscale.tailscale_set_dns_preferences

Parameter	Type	Required	Description
No parameters.

list_dns_search_paths Read

List DNS search paths Official Tailscale endpoint: GET /tailnet/{tailnet}/dns/searchpaths Retrieves the list of search paths, also referred to as *search domains*, that is currently set for the given tailnet.

Lua path: app.integrations.tailscale.list_dns_search_paths
Full name: tailscale.tailscale_list_dns_search_paths

Parameter	Type	Required	Description
No parameters.

set_dns_search_paths Write

Set DNS search paths Official Tailscale endpoint: POST /tailnet/{tailnet}/dns/searchpaths Replaces the list of search paths for the given tailnet.

Lua path: app.integrations.tailscale.set_dns_search_paths
Full name: tailscale.tailscale_set_dns_search_paths

Parameter	Type	Required	Description
No parameters.

get_split_dns Read

Get split DNS Official Tailscale endpoint: GET /tailnet/{tailnet}/dns/split-dns Retrieves the split DNS settings, which is a map from domains to lists of nameservers, that is currently set for the given tailnet.

Lua path: app.integrations.tailscale.get_split_dns
Full name: tailscale.tailscale_get_split_dns

Parameter	Type	Required	Description
No parameters.

set_split_dns Write

Set split DNS Official Tailscale endpoint: PUT /tailnet/{tailnet}/dns/split-dns Replaces the split DNS settings for a given tailnet. Setting the value of a mapping to `null` clears the nameservers for that domain. Sending an empty object cl

Lua path: app.integrations.tailscale.set_split_dns
Full name: tailscale.tailscale_set_split_dns

Parameter	Type	Required	Description
No parameters.

update_split_dns Write

Update split DNS Official Tailscale endpoint: PATCH /tailnet/{tailnet}/dns/split-dns Performs partial updates of the split DNS settings for a given tailnet. Only domains specified in the request map will be modified. Setting the value of a

Lua path: app.integrations.tailscale.update_split_dns
Full name: tailscale.tailscale_update_split_dns

Parameter	Type	Required	Description
No parameters.

get_dns_configuration Read

Get DNS configuration Official Tailscale endpoint: GET /tailnet/{tailnet}/dns/configuration Retrieves the full DNS configuration for a tailnet, including global nameservers, split DNS routes, search paths, and MagicDNS configuration.

Lua path: app.integrations.tailscale.get_dns_configuration
Full name: tailscale.tailscale_get_dns_configuration

Parameter	Type	Required	Description
No parameters.

set_dns_configuration Write

Set DNS configuration Official Tailscale endpoint: POST /tailnet/{tailnet}/dns/configuration Replaces the DNS configuration for the given tailnet. - `nameservers` defines the global resolvers to use when `preferences.overrideLocalDNS` is tr

Lua path: app.integrations.tailscale.set_dns_configuration
Full name: tailscale.tailscale_set_dns_configuration

Parameter	Type	Required	Description
No parameters.

list_tailnet_keys Read

List tailnet keys Official Tailscale endpoint: GET /tailnet/{tailnet}/keys Returns a list of active auth keys, API access tokens and trust credentials. If the parameter {all} was not specified, the set of keys returned depends on the access

Lua path: app.integrations.tailscale.list_tailnet_keys
Full name: tailscale.tailscale_list_tailnet_keys

Parameter	Type	Required	Description
No parameters.

create_auth_key_or_trust_credential Write

Create an auth key or trust credential Official Tailscale endpoint: POST /tailnet/{tailnet}/keys Creates a new [auth key](https://tailscale.com/kb/1085/), or [trust credential](https://tailscale.com/kb/1623/) in the specified tailnet. Trust

Lua path: app.integrations.tailscale.create_auth_key_or_trust_credential
Full name: tailscale.tailscale_create_key

Parameter	Type	Required	Description
No parameters.

get_key Read

Get key Official Tailscale endpoint: GET /tailnet/{tailnet}/keys/{keyId} Returns a JSON object with information about a specific api access token, OAuth client, federated identity, or auth key, such as its creation and expiration dates and

Lua path: app.integrations.tailscale.get_key
Full name: tailscale.tailscale_get_key

Parameter	Type	Required	Description
No parameters.

set_key Write

Set key Official Tailscale endpoint: PUT /tailnet/{tailnet}/keys/{keyId} Set the configuration for an existing OAuth client or federated identity. OAuth Scope: `oauth_keys` grants access to OAuth clients. OAuth Scope: `federated_keys` grant

Lua path: app.integrations.tailscale.set_key
Full name: tailscale.tailscale_set_key

Parameter	Type	Required	Description
No parameters.

delete_key Write

Delete key Official Tailscale endpoint: DELETE /tailnet/{tailnet}/keys/{keyId} Deletes a specific api access token or auth key. OAuth Scope: `api_access_tokens` grants access to personal API access tokens. OAuth Scope: `auth_keys` grants ac

Lua path: app.integrations.tailscale.delete_key
Full name: tailscale.tailscale_delete_key

Parameter	Type	Required	Description
No parameters.

get_policy_file Read

Get policy file Official Tailscale endpoint: GET /tailnet/{tailnet}/acl Retrieves the current policy file for the given tailnet; this includes the ACL along with the rules and tests that have been defined. This method can return the policy

Lua path: app.integrations.tailscale.get_policy_file
Full name: tailscale.tailscale_get_policy_file

Parameter	Type	Required	Description
No parameters.

set_policy_file Write

Set policy file Official Tailscale endpoint: POST /tailnet/{tailnet}/acl Sets the ACL for the given tailnet. HuJSON and JSON are both accepted inputs. An `If-Match` header can be set to avoid missed updates. On success, returns the updated

Lua path: app.integrations.tailscale.set_policy_file
Full name: tailscale.tailscale_set_policy_file

Parameter	Type	Required	Description
No parameters.

preview_rule_matches Write

Preview rule matches Official Tailscale endpoint: POST /tailnet/{tailnet}/acl/preview When given a user or IP port to match against, returns the tailnet policy rules that apply to that resource, without saving the policy file to the server.

Lua path: app.integrations.tailscale.preview_rule_matches
Full name: tailscale.tailscale_preview_rule_matches

Parameter	Type	Required	Description
No parameters.

validate_and_test_policy_file Write

Validate and test policy file Official Tailscale endpoint: POST /tailnet/{tailnet}/acl/validate This endpoint works in one of two modes, neither of which modifies your current tailnet policy file: - Run ACL tests: When the request body cont

Lua path: app.integrations.tailscale.validate_and_test_policy_file
Full name: tailscale.tailscale_validate_and_test_policy_file

Parameter	Type	Required	Description
No parameters.

list_all_posture_integrations Read

List all posture integrations Official Tailscale endpoint: GET /tailnet/{tailnet}/posture/integrations List all of the posture integrations for a tailnet. OAuth Scope: `feature_settings:read`.

Lua path: app.integrations.tailscale.list_all_posture_integrations
Full name: tailscale.tailscale_get_posture_integrations

Parameter	Type	Required	Description
No parameters.

create_posture_integration Write

Create a posture integration Official Tailscale endpoint: POST /tailnet/{tailnet}/posture/integrations Create a posture integration, returning the resulting [PostureIntegration](#model/postureintegration). Must include `provider` and `clien

Lua path: app.integrations.tailscale.create_posture_integration
Full name: tailscale.tailscale_create_posture_integration

Parameter	Type	Required	Description
No parameters.

get_posture_integration Read

Get a posture integration Official Tailscale endpoint: GET /posture/integrations/{id} Gets the posture integration identified by `{id}`. OAuth Scope: `feature_settings:read`.

Lua path: app.integrations.tailscale.get_posture_integration
Full name: tailscale.tailscale_get_posture_integration

Parameter	Type	Required	Description
No parameters.

update_posture_integration Write

Update a posture integration Official Tailscale endpoint: PATCH /posture/integrations/{id} Updates the posture integration identified by `{id}`. You may omit the `clientSecret` from your request to retain the previously configured `clientSe

Lua path: app.integrations.tailscale.update_posture_integration
Full name: tailscale.tailscale_update_posture_integration

Parameter	Type	Required	Description
No parameters.

delete_posture_integration Write

Delete a posture integration Official Tailscale endpoint: DELETE /posture/integrations/{id} Delete a specific posture integration. OAuth Scope: `feature_settings`.

Lua path: app.integrations.tailscale.delete_posture_integration
Full name: tailscale.tailscale_delete_posture_integration

Parameter	Type	Required	Description
No parameters.

list_users Read

List users Official Tailscale endpoint: GET /tailnet/{tailnet}/users List all users of a tailnet. OAuth Scope: `users:read`.

Lua path: app.integrations.tailscale.list_users
Full name: tailscale.tailscale_list_users

Parameter	Type	Required	Description
No parameters.

get_user Read

Get a user Official Tailscale endpoint: GET /users/{userId} Retrieve details about the specified user. OAuth Scope: `users:read`.

Lua path: app.integrations.tailscale.get_user
Full name: tailscale.tailscale_get_user

Parameter	Type	Required	Description
No parameters.

update_user_role Write

Update user role Official Tailscale endpoint: POST /users/{userId}/role Update the role for the specified user. Learn more about [user roles](kb/1138/user-roles). OAuth Scope: `users`. > ⓘ User-based access tokens cannot update their own

Lua path: app.integrations.tailscale.update_user_role
Full name: tailscale.tailscale_update_user_role

Parameter	Type	Required	Description
No parameters.

approve_user Write

Approve a user Official Tailscale endpoint: POST /users/{userId}/approve Approve a pending user's access to the tailnet. This is a no-op if user approval has not been enabled for the tailnet, or if the user is already approved. User approva

Lua path: app.integrations.tailscale.approve_user
Full name: tailscale.tailscale_approve_user

Parameter	Type	Required	Description
No parameters.

suspend_user Write

Suspend a user Official Tailscale endpoint: POST /users/{userId}/suspend Suspends a user from their tailnet. Learn more about [suspending users](/kb/1145/remove-team-members#suspending-users). OAuth Scope: `users`. > ⓘ User-based access t

Lua path: app.integrations.tailscale.suspend_user
Full name: tailscale.tailscale_suspend_user

Parameter	Type	Required	Description
No parameters.

restore_user Write

Restore a user Official Tailscale endpoint: POST /users/{userId}/restore Restores a suspended user's access to their tailnet. Learn more about [restoring users](/kb/1145/remove-team-members#restoring-users). OAuth Scope: `users`. > ⓘ User

Lua path: app.integrations.tailscale.restore_user
Full name: tailscale.tailscale_restore_user

Parameter	Type	Required	Description
No parameters.

delete_user Write

Delete a user Official Tailscale endpoint: POST /users/{userId}/delete Delete a user from their tailnet. Learn more about [deleting users](/kb/1145/remove-team-members#deleting-users). OAuth Scope: `users`. > ⓘ User-based access tokens ca

Lua path: app.integrations.tailscale.delete_user
Full name: tailscale.tailscale_delete_user

Parameter	Type	Required	Description
No parameters.

get_contacts Read

Get contacts Official Tailscale endpoint: GET /tailnet/{tailnet}/contacts Retrieve the tailnet's current contacts. OAuth Scope: `account_settings:read`.

Lua path: app.integrations.tailscale.get_contacts
Full name: tailscale.tailscale_get_contacts

Parameter	Type	Required	Description
No parameters.

update_contact Write

Update contact Official Tailscale endpoint: PATCH /tailnet/{tailnet}/contacts/{contactType} Update the preferences for this type of contact. If the email address has changed, the system will send a verification email to confirm the change.

Lua path: app.integrations.tailscale.update_contact
Full name: tailscale.tailscale_update_contact

Parameter	Type	Required	Description
No parameters.

resend_verification_email Write

Resend verification email Official Tailscale endpoint: POST /tailnet/{tailnet}/contacts/{contactType}/resend-verification-email Resends the verification email for this contact, if and only if verification is still pending. OAuth Scope: `acc

Lua path: app.integrations.tailscale.resend_verification_email
Full name: tailscale.tailscale_resend_contact_verification_email

Parameter	Type	Required	Description
No parameters.

list_webhooks Read

List webhooks Official Tailscale endpoint: GET /tailnet/{tailnet}/webhooks List all webhooks for a tailnet. OAuth Scope: `webhooks:read`.

Lua path: app.integrations.tailscale.list_webhooks
Full name: tailscale.tailscale_list_webhooks

Parameter	Type	Required	Description
No parameters.

create_webhook Write

Create a webhook Official Tailscale endpoint: POST /tailnet/{tailnet}/webhooks Create a webhook within a tailnet. OAuth Scope: `webhooks`.

Lua path: app.integrations.tailscale.create_webhook
Full name: tailscale.tailscale_create_webhook

Parameter	Type	Required	Description
No parameters.

get_webhook Read

Get webhook Official Tailscale endpoint: GET /webhooks/{endpointId} Retrieve a specific webhook. OAuth Scope: `webhooks:read`.

Lua path: app.integrations.tailscale.get_webhook
Full name: tailscale.tailscale_get_webhook

Parameter	Type	Required	Description
No parameters.

update_webhook Write

Update webhook Official Tailscale endpoint: PATCH /webhooks/{endpointId} Update a specific webhook. OAuth Scope: `webhooks`.

Lua path: app.integrations.tailscale.update_webhook
Full name: tailscale.tailscale_update_webhook

Parameter	Type	Required	Description
No parameters.

delete_webhook Write

Delete webhook Official Tailscale endpoint: DELETE /webhooks/{endpointId} Delete a specific webhook. OAuth Scope: `webhooks`.

Lua path: app.integrations.tailscale.delete_webhook
Full name: tailscale.tailscale_delete_webhook

Parameter	Type	Required	Description
No parameters.

test_webhook Write

Test a webhook Official Tailscale endpoint: POST /webhooks/{endpointId}/test Test a specific webhook by sending out a test event to the endpoint URL. This endpoint queues the event which is sent out asynchronously. If your webhook is config

Lua path: app.integrations.tailscale.test_webhook
Full name: tailscale.tailscale_test_webhook

Parameter	Type	Required	Description
No parameters.

rotate_webhook_secret Write

Rotate webhook secret Official Tailscale endpoint: POST /webhooks/{endpointId}/rotate Rotate and generate a new secret for a specific webhook. This secret is used for generating the `Tailscale-Webhook-Signature` header in requests sent to t

Lua path: app.integrations.tailscale.rotate_webhook_secret
Full name: tailscale.tailscale_rotate_webhook_secret

Parameter	Type	Required	Description
No parameters.

get_tailnet_settings Read

Get tailnet settings Official Tailscale endpoint: GET /tailnet/{tailnet}/settings Retrieve the settings for a specific tailnet. OAuth Scope: `feature_settings:read` - required to view all settings except those governed by the below scopes.

Lua path: app.integrations.tailscale.get_tailnet_settings
Full name: tailscale.tailscale_get_tailnet_settings

Parameter	Type	Required	Description
No parameters.

update_tailnet_settings Write

Update tailnet settings Official Tailscale endpoint: PATCH /tailnet/{tailnet}/settings Update the settings for a specific tailnet. OAuth Scope: `feature_settings` - required to update all settings except those governed by the below scopes.

Lua path: app.integrations.tailscale.update_tailnet_settings
Full name: tailscale.tailscale_update_tailnet_settings

Parameter	Type	Required	Description
No parameters.

list_all_services Read

List all Services Official Tailscale endpoint: GET /tailnet/{tailnet}/services List all Services configured for the tailnet. This includes all Services in the \"advertised\" tab of the Services page in the Tailscale admin console. OAuth Scope

Lua path: app.integrations.tailscale.list_all_services
Full name: tailscale.tailscale_list_services

Parameter	Type	Required	Description
No parameters.

get_service Read

Get a Service Official Tailscale endpoint: GET /tailnet/{tailnet}/services/{serviceName} Retrieve the details for the specified Service. OAuth Scope: `services:read`.

Lua path: app.integrations.tailscale.get_service
Full name: tailscale.tailscale_get_service

Parameter	Type	Required	Description
No parameters.

update_service Write

Update a Service Official Tailscale endpoint: PUT /tailnet/{tailnet}/services/{serviceName} Update or create the specified Service. If the Service does not exist, it will create a Service with the provided details. When creating a new Servi

Lua path: app.integrations.tailscale.update_service
Full name: tailscale.tailscale_update_service

Parameter	Type	Required	Description
No parameters.

delete_service Write

Delete a Service Official Tailscale endpoint: DELETE /tailnet/{tailnet}/services/{serviceName} Delete the specified Service from the tailnet. OAuth Scope: `services`.

Lua path: app.integrations.tailscale.delete_service
Full name: tailscale.tailscale_delete_service

Parameter	Type	Required	Description
No parameters.

list_devices_hosting_service Read

List devices hosting a Service Official Tailscale endpoint: GET /tailnet/{tailnet}/services/{serviceName}/devices List all devices that are hosting the specified Service. OAuth Scope: `services`, `devices:core`.

Lua path: app.integrations.tailscale.list_devices_hosting_service
Full name: tailscale.tailscale_list_service_hosts

Parameter	Type	Required	Description
No parameters.

get_approval_status_service_device Read

Get approval status of Service on a device Official Tailscale endpoint: GET /tailnet/{tailnet}/services/{serviceName}/device/{deviceId}/approved Retrieve the approval status of the specified Service on a specific device. OAuth Scope: `servi

Lua path: app.integrations.tailscale.get_approval_status_service_device
Full name: tailscale.tailscale_get_service_device_approval

Parameter	Type	Required	Description
No parameters.

update_approval_status_service_device Write

Update approval status of Service on a device Official Tailscale endpoint: POST /tailnet/{tailnet}/services/{serviceName}/device/{deviceId}/approved Update the approval status of the specified Service on a specific device. OAuth Scope: `ser

Lua path: app.integrations.tailscale.update_approval_status_service_device
Full name: tailscale.tailscale_update_service_device_approval

Parameter	Type	Required	Description
No parameters.