# Tailscale (/integrations/tailscale)





{/* MANUAL-CONTENT-START:intro */}

Use [Tailscale](https://tailscale.com) to manage devices, DNS, ACLs, auth keys, users, and routes in a tailnet.

## Authentication [#authentication]

The Tailscale block uses API key authentication. To get an API key:

1. Go to the [Tailscale admin console](https://login.tailscale.com/admin/settings/keys)
2. Navigate to **Settings > Keys**
3. Click **Generate API key**
4. Set an expiry (1-90 days) and copy the key (starts with `tskey-api-`)

You must have an **Owner**, **Admin**, **IT admin**, or **Network admin** role to generate API keys.

## Tailnet identifier [#tailnet-identifier]

Every operation requires a **tailnet** parameter. This is typically your organization's domain name (e.g., `example.com`). You can also use `"-"` to refer to your default tailnet.

{/* MANUAL-CONTENT-END */}

## Use the block [#usage-instructions]

Interact with the Tailscale API to manage devices, DNS, ACLs, auth keys, users, and routes across your tailnet.

## Actions [#actions]

### Tailscale List Devices [#tailscale-list-devices]

List all devices in the tailnet

<ReferenceDetails>
  #### Input [#input]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output]

  | Parameter | Type | Description |
  | - | - | - |
  | `devices` | array | List of devices in the tailnet |
  | ↳ `id` | string | Legacy device ID |
  | ↳ `nodeId` | string | Preferred device ID |
  | ↳ `name` | string | Device name |
  | ↳ `hostname` | string | Device hostname |
  | ↳ `user` | string | Associated user |
  | ↳ `os` | string | Operating system |
  | ↳ `clientVersion` | string | Tailscale client version |
  | ↳ `addresses` | array | Tailscale IP addresses |
  | ↳ `tags` | array | Device tags |
  | ↳ `authorized` | boolean | Whether the device is authorized |
  | ↳ `blocksIncomingConnections` | boolean | Whether the device blocks incoming connections |
  | ↳ `keyExpiryDisabled` | boolean | Whether the device key is exempt from expiring |
  | ↳ `expires` | string | The device's auth key expiration timestamp |
  | ↳ `lastSeen` | string | Last seen timestamp |
  | ↳ `created` | string | Creation timestamp |
  | `count` | number | Total number of devices |
</ReferenceDetails>

### Tailscale Get Device [#tailscale-get-device]

Get details of a specific device by ID

<ReferenceDetails>
  #### Input [#input-1]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID |

  #### Output [#output-1]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Legacy device ID |
  | `nodeId` | string | Preferred device ID |
  | `name` | string | Device name |
  | `hostname` | string | Device hostname |
  | `user` | string | Associated user |
  | `os` | string | Operating system |
  | `clientVersion` | string | Tailscale client version |
  | `addresses` | array | Tailscale IP addresses |
  | `tags` | array | Device tags |
  | `authorized` | boolean | Whether the device is authorized |
  | `blocksIncomingConnections` | boolean | Whether the device blocks incoming connections |
  | `keyExpiryDisabled` | boolean | Whether the device key is exempt from expiring |
  | `expires` | string | The device's auth key expiration timestamp |
  | `lastSeen` | string | Last seen timestamp |
  | `created` | string | Creation timestamp |
  | `isExternal` | boolean | Whether the device is external |
  | `updateAvailable` | boolean | Whether an update is available |
  | `machineKey` | string | Machine key |
  | `nodeKey` | string | Node key |
</ReferenceDetails>

### Tailscale Delete Device [#tailscale-delete-device]

Remove a device from the tailnet

<ReferenceDetails>
  #### Input [#input-2]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID to delete |

  #### Output [#output-2]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the device was successfully deleted |
  | `deviceId` | string | ID of the deleted device |
</ReferenceDetails>

### Tailscale Authorize Device [#tailscale-authorize-device]

Authorize or deauthorize a device on the tailnet

<ReferenceDetails>
  #### Input [#input-3]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID to authorize |
  | `authorized` | boolean | Yes | Whether to authorize (true) or deauthorize (false) the device |

  #### Output [#output-3]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the operation succeeded |
  | `deviceId` | string | Device ID |
  | `authorized` | boolean | Authorization status after the operation |
</ReferenceDetails>

### Tailscale Set Device Tags [#tailscale-set-device-tags]

Set tags on a device in the tailnet

<ReferenceDetails>
  #### Input [#input-4]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID |
  | `tags` | string | Yes | Comma-separated list of tags (e.g., "tag:server,tag:production") |

  #### Output [#output-4]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the tags were successfully set |
  | `deviceId` | string | Device ID |
  | `tags` | array | Tags set on the device |
</ReferenceDetails>

### Tailscale Get Device Routes [#tailscale-get-device-routes]

Get the subnet routes for a device

<ReferenceDetails>
  #### Input [#input-5]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID |

  #### Output [#output-5]

  | Parameter | Type | Description |
  | - | - | - |
  | `advertisedRoutes` | array | Subnet routes the device is advertising |
  | `enabledRoutes` | array | Subnet routes that are approved/enabled |
</ReferenceDetails>

### Tailscale Set Device Routes [#tailscale-set-device-routes]

Set the enabled subnet routes for a device

<ReferenceDetails>
  #### Input [#input-6]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID |
  | `routes` | string | Yes | Comma-separated list of subnet routes to enable (e.g., "10.0.0.0/24,192.168.1.0/24") |

  #### Output [#output-6]

  | Parameter | Type | Description |
  | - | - | - |
  | `advertisedRoutes` | array | Subnet routes the device is advertising |
  | `enabledRoutes` | array | Subnet routes that are now enabled |
</ReferenceDetails>

### Tailscale Update Device Key [#tailscale-update-device-key]

Enable or disable key expiry on a device

<ReferenceDetails>
  #### Input [#input-7]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID |
  | `keyExpiryDisabled` | boolean | Yes | Whether to disable key expiry (true) or enable it (false) |

  #### Output [#output-7]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the operation succeeded |
  | `deviceId` | string | Device ID |
  | `keyExpiryDisabled` | boolean | Whether key expiry is now disabled |
</ReferenceDetails>

### Tailscale Expire Device Key [#tailscale-expire-device-key]

Immediately expire a device's node key, requiring it to re-authenticate before it can reconnect to the tailnet

<ReferenceDetails>
  #### Input [#input-8]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `deviceId` | string | Yes | Device ID to expire the key for |

  #### Output [#output-8]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the device's key was successfully expired |
  | `deviceId` | string | Device ID |
</ReferenceDetails>

### Tailscale List DNS Nameservers [#tailscale-list-dns-nameservers]

Get the DNS nameservers configured for the tailnet

<ReferenceDetails>
  #### Input [#input-9]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output-9]

  | Parameter | Type | Description |
  | - | - | - |
  | `dns` | array | List of DNS nameserver addresses |
</ReferenceDetails>

### Tailscale Set DNS Nameservers [#tailscale-set-dns-nameservers]

Set the DNS nameservers for the tailnet

<ReferenceDetails>
  #### Input [#input-10]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `dns` | string | Yes | Comma-separated list of DNS nameserver IP addresses (e.g., "8.8.8.8,8.8.4.4") |

  #### Output [#output-10]

  | Parameter | Type | Description |
  | - | - | - |
  | `dns` | array | Updated list of DNS nameserver addresses |
  | `magicDNS` | boolean | Whether MagicDNS is enabled |
</ReferenceDetails>

### Tailscale Get DNS Preferences [#tailscale-get-dns-preferences]

Get the DNS preferences for the tailnet including MagicDNS status

<ReferenceDetails>
  #### Input [#input-11]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output-11]

  | Parameter | Type | Description |
  | - | - | - |
  | `magicDNS` | boolean | Whether MagicDNS is enabled |
</ReferenceDetails>

### Tailscale Set DNS Preferences [#tailscale-set-dns-preferences]

Set DNS preferences for the tailnet (enable/disable MagicDNS)

<ReferenceDetails>
  #### Input [#input-12]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `magicDNS` | boolean | Yes | Whether to enable (true) or disable (false) MagicDNS |

  #### Output [#output-12]

  | Parameter | Type | Description |
  | - | - | - |
  | `magicDNS` | boolean | Updated MagicDNS status |
</ReferenceDetails>

### Tailscale Get DNS Search Paths [#tailscale-get-dns-search-paths]

Get the DNS search paths configured for the tailnet

<ReferenceDetails>
  #### Input [#input-13]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output-13]

  | Parameter | Type | Description |
  | - | - | - |
  | `searchPaths` | array | List of DNS search path domains |
</ReferenceDetails>

### Tailscale Set DNS Search Paths [#tailscale-set-dns-search-paths]

Set the DNS search paths for the tailnet

<ReferenceDetails>
  #### Input [#input-14]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `searchPaths` | string | Yes | Comma-separated list of DNS search path domains (e.g., "corp.example.com,internal.example.com") |

  #### Output [#output-14]

  | Parameter | Type | Description |
  | - | - | - |
  | `searchPaths` | array | Updated list of DNS search path domains |
</ReferenceDetails>

### Tailscale List Users [#tailscale-list-users]

List all users in the tailnet

<ReferenceDetails>
  #### Input [#input-15]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output-15]

  | Parameter | Type | Description |
  | - | - | - |
  | `users` | array | List of users in the tailnet |
  | ↳ `id` | string | User ID |
  | ↳ `displayName` | string | Display name |
  | ↳ `loginName` | string | Login name / email |
  | ↳ `profilePicURL` | string | Profile picture URL |
  | ↳ `role` | string | User role (owner, admin, member, etc.) |
  | ↳ `status` | string | User status (active, suspended, etc.) |
  | ↳ `type` | string | User type (member, shared, tagged) |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `lastSeen` | string | Last seen timestamp |
  | ↳ `deviceCount` | number | Number of devices owned by user |
  | `count` | number | Total number of users |
</ReferenceDetails>

### Tailscale Suspend User [#tailscale-suspend-user]

Suspend a user's access to the tailnet

<ReferenceDetails>
  #### Input [#input-16]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `userId` | string | Yes | User ID to suspend |

  #### Output [#output-16]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the user was successfully suspended |
  | `userId` | string | ID of the suspended user |
</ReferenceDetails>

### Tailscale Delete User [#tailscale-delete-user]

Delete a user from the tailnet

<ReferenceDetails>
  #### Input [#input-17]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `userId` | string | Yes | User ID to delete |

  #### Output [#output-17]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the user was successfully deleted |
  | `userId` | string | ID of the deleted user |
</ReferenceDetails>

### Tailscale Create Auth Key [#tailscale-create-auth-key]

Create a new auth key for the tailnet to pre-authorize devices

<ReferenceDetails>
  #### Input [#input-18]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `reusable` | boolean | No | Whether the key can be used more than once |
  | `ephemeral` | boolean | No | Whether devices authenticated with this key are ephemeral |
  | `preauthorized` | boolean | No | Whether devices are pre-authorized (skip manual approval) |
  | `tags` | string | No | Comma-separated list of tags for devices using this key (e.g., "tag:server,tag:prod") |
  | `description` | string | No | Description for the auth key |
  | `expirySeconds` | number | No | Key expiry time in seconds (default: 90 days) |

  #### Output [#output-18]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Auth key ID |
  | `key` | string | The auth key value (only shown once at creation) |
  | `description` | string | Key description |
  | `created` | string | Creation timestamp |
  | `expires` | string | Expiration timestamp |
  | `revoked` | string | Revocation timestamp (empty if not revoked) |
  | `capabilities` | object | Key capabilities |
  | ↳ `reusable` | boolean | Whether the key is reusable |
  | ↳ `ephemeral` | boolean | Whether devices are ephemeral |
  | ↳ `preauthorized` | boolean | Whether devices are pre-authorized |
  | ↳ `tags` | array | Tags applied to devices using this key |
</ReferenceDetails>

### Tailscale List Auth Keys [#tailscale-list-auth-keys]

List all auth keys in the tailnet

<ReferenceDetails>
  #### Input [#input-19]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output-19]

  | Parameter | Type | Description |
  | - | - | - |
  | `keys` | array | List of auth keys |
  | ↳ `id` | string | Auth key ID |
  | ↳ `description` | string | Key description |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `expires` | string | Expiration timestamp |
  | ↳ `revoked` | string | Revocation timestamp |
  | ↳ `capabilities` | object | Key capabilities |
  | ↳ `reusable` | boolean | Whether the key is reusable |
  | ↳ `ephemeral` | boolean | Whether devices are ephemeral |
  | ↳ `preauthorized` | boolean | Whether devices are pre-authorized |
  | ↳ `tags` | array | Tags applied to devices |
  | `count` | number | Total number of auth keys |
</ReferenceDetails>

### Tailscale Get Auth Key [#tailscale-get-auth-key]

Get details of a specific auth key

<ReferenceDetails>
  #### Input [#input-20]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `keyId` | string | Yes | Auth key ID |

  #### Output [#output-20]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Auth key ID |
  | `description` | string | Key description |
  | `created` | string | Creation timestamp |
  | `expires` | string | Expiration timestamp |
  | `revoked` | string | Revocation timestamp |
  | `capabilities` | object | Key capabilities |
  | ↳ `reusable` | boolean | Whether the key is reusable |
  | ↳ `ephemeral` | boolean | Whether devices are ephemeral |
  | ↳ `preauthorized` | boolean | Whether devices are pre-authorized |
  | ↳ `tags` | array | Tags applied to devices using this key |
</ReferenceDetails>

### Tailscale Delete Auth Key [#tailscale-delete-auth-key]

Revoke and delete an auth key

<ReferenceDetails>
  #### Input [#input-21]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `keyId` | string | Yes | Auth key ID to delete |

  #### Output [#output-21]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the auth key was successfully deleted |
  | `keyId` | string | ID of the deleted auth key |
</ReferenceDetails>

### Tailscale Get ACL [#tailscale-get-acl]

Get the current ACL policy for the tailnet

<ReferenceDetails>
  #### Input [#input-22]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |

  #### Output [#output-22]

  | Parameter | Type | Description |
  | - | - | - |
  | `acl` | string | ACL policy as JSON string |
  | `etag` | string | ETag for the current ACL version (use with If-Match header for updates) |
</ReferenceDetails>

### Tailscale Set ACL [#tailscale-set-acl]

Replace the ACL policy file for the tailnet

<ReferenceDetails>
  #### Input [#input-23]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Tailscale API key |
  | `tailnet` | string | Yes | Tailnet name (e.g., example.com) or "-" for default |
  | `acl` | string | Yes | The new ACL policy file, as a JSON string |
  | `ifMatch` | string | No | ETag from a prior Get ACL call to avoid overwriting concurrent updates. Use "ts-default" to only replace an untouched default policy file. |

  #### Output [#output-23]

  | Parameter | Type | Description |
  | - | - | - |
  | `acl` | string | Updated ACL policy as JSON string |
  | `etag` | string | ETag for the new ACL version (use with If-Match header for future updates) |
</ReferenceDetails>