Tailscale

Use Tailscale to manage devices, DNS, ACLs, auth keys, users, and routes in a tailnet.

Authentication

The Tailscale block uses API key authentication. To get an API key:

Go to the Tailscale admin console
Navigate to Settings > Keys
Click Generate API key
Set an expiry (1-90 days) and copy the key (starts with tskey-api-)

You must have an Owner, Admin, IT admin, or Network admin role to generate API keys.

Tailnet identifier

Every operation requires a tailnet parameter. This is typically your organization's domain name (e.g., example.com). You can also use "-" to refer to your default tailnet.

Use the block

Interact with the Tailscale API to manage devices, DNS, ACLs, auth keys, users, and routes across your tailnet.

Actions

Tailscale List Devices

List all devices in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`devices`	array	List of devices in the tailnet
↳ `id`	string	Legacy device ID
↳ `nodeId`	string	Preferred device ID
↳ `name`	string	Device name
↳ `hostname`	string	Device hostname
↳ `user`	string	Associated user
↳ `os`	string	Operating system
↳ `clientVersion`	string	Tailscale client version
↳ `addresses`	array	Tailscale IP addresses
↳ `tags`	array	Device tags
↳ `authorized`	boolean	Whether the device is authorized
↳ `blocksIncomingConnections`	boolean	Whether the device blocks incoming connections
↳ `keyExpiryDisabled`	boolean	Whether the device key is exempt from expiring
↳ `expires`	string	The device's auth key expiration timestamp
↳ `lastSeen`	string	Last seen timestamp
↳ `created`	string	Creation timestamp
`count`	number	Total number of devices

Tailscale Get Device

Get details of a specific device by ID

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID

Output

Parameter	Type	Description
`id`	string	Legacy device ID
`nodeId`	string	Preferred device ID
`name`	string	Device name
`hostname`	string	Device hostname
`user`	string	Associated user
`os`	string	Operating system
`clientVersion`	string	Tailscale client version
`addresses`	array	Tailscale IP addresses
`tags`	array	Device tags
`authorized`	boolean	Whether the device is authorized
`blocksIncomingConnections`	boolean	Whether the device blocks incoming connections
`keyExpiryDisabled`	boolean	Whether the device key is exempt from expiring
`expires`	string	The device's auth key expiration timestamp
`lastSeen`	string	Last seen timestamp
`created`	string	Creation timestamp
`isExternal`	boolean	Whether the device is external
`updateAvailable`	boolean	Whether an update is available
`machineKey`	string	Machine key
`nodeKey`	string	Node key

Tailscale Delete Device

Remove a device from the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID to delete

Output

Parameter	Type	Description
`success`	boolean	Whether the device was successfully deleted
`deviceId`	string	ID of the deleted device

Tailscale Authorize Device

Authorize or deauthorize a device on the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID to authorize
`authorized`	boolean	Yes	Whether to authorize (true) or deauthorize (false) the device

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	Device ID
`authorized`	boolean	Authorization status after the operation

Tailscale Set Device Tags

Set tags on a device in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID
`tags`	string	Yes	Comma-separated list of tags (e.g., "tag:server,tag:production")

Output

Parameter	Type	Description
`success`	boolean	Whether the tags were successfully set
`deviceId`	string	Device ID
`tags`	array	Tags set on the device

Tailscale Get Device Routes

Get the subnet routes for a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID

Output

Parameter	Type	Description
`advertisedRoutes`	array	Subnet routes the device is advertising
`enabledRoutes`	array	Subnet routes that are approved/enabled

Tailscale Set Device Routes

Set the enabled subnet routes for a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID
`routes`	string	Yes	Comma-separated list of subnet routes to enable (e.g., "10.0.0.0/24,192.168.1.0/24")

Output

Parameter	Type	Description
`advertisedRoutes`	array	Subnet routes the device is advertising
`enabledRoutes`	array	Subnet routes that are now enabled

Tailscale Update Device Key

Enable or disable key expiry on a device

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID
`keyExpiryDisabled`	boolean	Yes	Whether to disable key expiry (true) or enable it (false)

Output

Parameter	Type	Description
`success`	boolean	Whether the operation succeeded
`deviceId`	string	Device ID
`keyExpiryDisabled`	boolean	Whether key expiry is now disabled

Tailscale Expire Device Key

Immediately expire a device's node key, requiring it to re-authenticate before it can reconnect to the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`deviceId`	string	Yes	Device ID to expire the key for

Output

Parameter	Type	Description
`success`	boolean	Whether the device's key was successfully expired
`deviceId`	string	Device ID

Tailscale List DNS Nameservers

Get the DNS nameservers configured for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`dns`	array	List of DNS nameserver addresses

Tailscale Set DNS Nameservers

Set the DNS nameservers for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`dns`	string	Yes	Comma-separated list of DNS nameserver IP addresses (e.g., "8.8.8.8,8.8.4.4")

Output

Parameter	Type	Description
`dns`	array	Updated list of DNS nameserver addresses
`magicDNS`	boolean	Whether MagicDNS is enabled

Tailscale Get DNS Preferences

Get the DNS preferences for the tailnet including MagicDNS status

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`magicDNS`	boolean	Whether MagicDNS is enabled

Tailscale Set DNS Preferences

Set DNS preferences for the tailnet (enable/disable MagicDNS)

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`magicDNS`	boolean	Yes	Whether to enable (true) or disable (false) MagicDNS

Output

Parameter	Type	Description
`magicDNS`	boolean	Updated MagicDNS status

Tailscale Get DNS Search Paths

Get the DNS search paths configured for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`searchPaths`	array	List of DNS search path domains

Tailscale Set DNS Search Paths

Set the DNS search paths for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`searchPaths`	string	Yes	Comma-separated list of DNS search path domains (e.g., "corp.example.com,internal.example.com")

Output

Parameter	Type	Description
`searchPaths`	array	Updated list of DNS search path domains

Tailscale List Users

List all users in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`users`	array	List of users in the tailnet
↳ `id`	string	User ID
↳ `displayName`	string	Display name
↳ `loginName`	string	Login name / email
↳ `profilePicURL`	string	Profile picture URL
↳ `role`	string	User role (owner, admin, member, etc.)
↳ `status`	string	User status (active, suspended, etc.)
↳ `type`	string	User type (member, shared, tagged)
↳ `created`	string	Creation timestamp
↳ `lastSeen`	string	Last seen timestamp
↳ `deviceCount`	number	Number of devices owned by user
`count`	number	Total number of users

Tailscale Suspend User

Suspend a user's access to the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`userId`	string	Yes	User ID to suspend

Output

Parameter	Type	Description
`success`	boolean	Whether the user was successfully suspended
`userId`	string	ID of the suspended user

Tailscale Delete User

Delete a user from the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`userId`	string	Yes	User ID to delete

Output

Parameter	Type	Description
`success`	boolean	Whether the user was successfully deleted
`userId`	string	ID of the deleted user

Tailscale Create Auth Key

Create a new auth key for the tailnet to pre-authorize devices

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`reusable`	boolean	No	Whether the key can be used more than once
`ephemeral`	boolean	No	Whether devices authenticated with this key are ephemeral
`preauthorized`	boolean	No	Whether devices are pre-authorized (skip manual approval)
`tags`	string	No	Comma-separated list of tags for devices using this key (e.g., "tag:server,tag:prod")
`description`	string	No	Description for the auth key
`expirySeconds`	number	No	Key expiry time in seconds (default: 90 days)

Output

Parameter	Type	Description
`id`	string	Auth key ID
`key`	string	The auth key value (only shown once at creation)
`description`	string	Key description
`created`	string	Creation timestamp
`expires`	string	Expiration timestamp
`revoked`	string	Revocation timestamp (empty if not revoked)
`capabilities`	object	Key capabilities
↳ `reusable`	boolean	Whether the key is reusable
↳ `ephemeral`	boolean	Whether devices are ephemeral
↳ `preauthorized`	boolean	Whether devices are pre-authorized
↳ `tags`	array	Tags applied to devices using this key

Tailscale List Auth Keys

List all auth keys in the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`keys`	array	List of auth keys
↳ `id`	string	Auth key ID
↳ `description`	string	Key description
↳ `created`	string	Creation timestamp
↳ `expires`	string	Expiration timestamp
↳ `revoked`	string	Revocation timestamp
↳ `capabilities`	object	Key capabilities
↳ `reusable`	boolean	Whether the key is reusable
↳ `ephemeral`	boolean	Whether devices are ephemeral
↳ `preauthorized`	boolean	Whether devices are pre-authorized
↳ `tags`	array	Tags applied to devices
`count`	number	Total number of auth keys

Tailscale Get Auth Key

Get details of a specific auth key

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`keyId`	string	Yes	Auth key ID

Output

Parameter	Type	Description
`id`	string	Auth key ID
`description`	string	Key description
`created`	string	Creation timestamp
`expires`	string	Expiration timestamp
`revoked`	string	Revocation timestamp
`capabilities`	object	Key capabilities
↳ `reusable`	boolean	Whether the key is reusable
↳ `ephemeral`	boolean	Whether devices are ephemeral
↳ `preauthorized`	boolean	Whether devices are pre-authorized
↳ `tags`	array	Tags applied to devices using this key

Tailscale Delete Auth Key

Revoke and delete an auth key

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`keyId`	string	Yes	Auth key ID to delete

Output

Parameter	Type	Description
`success`	boolean	Whether the auth key was successfully deleted
`keyId`	string	ID of the deleted auth key

Tailscale Get ACL

Get the current ACL policy for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default

Output

Parameter	Type	Description
`acl`	string	ACL policy as JSON string
`etag`	string	ETag for the current ACL version (use with If-Match header for updates)

Tailscale Set ACL

Replace the ACL policy file for the tailnet

Inputs and outputs

Input

Parameter	Type	Required	Description
`apiKey`	string	Yes	Tailscale API key
`tailnet`	string	Yes	Tailnet name (e.g., example.com) or "-" for default
`acl`	string	Yes	The new ACL policy file, as a JSON string
`ifMatch`	string	No	ETag from a prior Get ACL call to avoid overwriting concurrent updates. Use "ts-default" to only replace an untouched default policy file.

Output

Parameter	Type	Description
`acl`	string	Updated ACL policy as JSON string
`etag`	string	ETag for the new ACL version (use with If-Match header for future updates)

Tailscale

On this page