tailscale/publicapi

Tailscale API

The Tailscale API is a (mostly) RESTful API. Typically, both POST bodies and responses are JSON-encoded.

Base URL

The base URL for the Tailscale API is https://api.tailscale.com/api/v2/.

Examples in this document may abbreviate this to /api/v2/.

Authentication

Requests to the Tailscale API are authenticated with an API access token (sometimes called an API key). Access tokens can be supplied as the username portion of HTTP Basic authentication (leave the password blank) or as an OAuth Bearer token:

# passing token with basic auth
curl -u "tskey-api-xxxxx:" https://api.tailscale.com/api/v2/...

# passing token as bearer token
curl -H "Authorization: Bearer tskey-api-xxxxx" https://api.tailscale.com/api/v2/...

Access tokens for individual users can be created and managed from the Keys page of the admin console. These tokens will have the same permissions as the owning user, and can be set to expire in 1 to 90 days. Access tokens are identifiable by the prefix tskey-api-.

Alternatively, an OAuth client can be used to create short-lived access tokens with scoped permission. OAuth clients don't expire, and can therefore be used to provide ongoing access to the API, creating access tokens as needed. OAuth clients and the access tokens they create are not tied to an individual Tailscale user. OAuth client secrets are identifiable by the prefix tskey-client-. Learn more about OAuth clients.

Errors

The Tailscale API returns status codes consistent with standard HTTP conventions. In addition to the status code, errors may include additional information in the response body:

{
  "message": "additional error information"
}

Pagination

The Tailscale API does not currently support pagination. All results are returned at once.

APIs

Device

• Get a device: GET /api/v2/device/{deviceid}
• Delete a device: DELETE /api/v2/device/{deviceID}
• Expire device key: POST /api/v2/device/{deviceID}/expire
• Routes
  • Get device routes: GET /api/v2/device/{deviceID}/routes
  • Set device routes: POST /api/v2/device/{deviceID}/routes
• Authorize
  • Authorize a device: POST /api/v2/device/{deviceID}/authorized
• Tags
  • Update tags: POST /api/v2/device/{deviceID}/tags
• Keys
  • Update device key: POST /api/v2/device/{deviceID}/key
• IP Addresses
  • Set device IPv4 address: POST /api/v2/device/{deviceID}/ip
• Device posture attributes
  • Get device posture attributes: GET /api/v2/device/{deviceID}/attributes
  • Set custom device posture attributes: POST /api/v2/device/{deviceID}/attributes/{attributeKey}
  • Delete custom device posture attributes: DELETE /api/v2/device/{deviceID}/attributes/{attributeKey}
• Device invites
  • List device invites: GET /api/v2/device/{deviceID}/device-invites
  • Create device invites: POST /api/v2/device/{deviceID}/device-invites

Tailnet

• Policy File
  • Get policy file: GET /api/v2/tailnet/{tailnet}/acl
  • Update policy file: POST /api/v2/tailnet/{tailnet}/acl
  • Preview rule matches: POST /api/v2/tailnet/{tailnet}/acl/preview
  • Validate and test policy file: POST /api/v2/tailnet/{tailnet}/acl/validate
• Devices
  • List tailnet devices: GET /api/v2/tailnet/{tailnet}/devices
• Keys
  • List tailnet keys: GET /api/v2/tailnet/{tailnet}/keys
  • Create an auth key: POST /api/v2/tailnet/{tailnet}/keys
  • Get a key: GET /api/v2/tailnet/{tailnet}/keys/{keyid}
  • Delete a key: DELETE /api/v2/tailnet/{tailnet}/keys/{keyid}
• DNS
  • Nameservers
  • Get nameservers: GET /api/v2/tailnet/{tailnet}/dns/nameservers
  • Set nameservers: POST /api/v2/tailnet/{tailnet}/dns/nameservers
  • Preferences
  • Get DNS preferences: GET /api/v2/tailnet/{tailnet}/dns/preferences
  • Set DNS preferences: POST /api/v2/tailnet/{tailnet}/dns/preferences
  • Search Paths
  • Get search paths: GET /api/v2/tailnet/{tailnet}/dns/searchpaths
  • Set search paths: POST /api/v2/tailnet/{tailnet}/dns/searchpaths
  • Split DNS
  • Get split DNS: GET /api/v2/tailnet/{tailnet}/dns/split-dns
  • Update split DNS: PATCH /api/v2/tailnet/{tailnet}/dns/split-dns
  • Set split DNS: PUT /api/v2/tailnet/{tailnet}/dns/split-dns
• User invites
  • List user invites: GET /api/v2/tailnet/{tailnet}/user-invites
  • Create user invites: POST /api/v2/tailnet/{tailnet}/user-invites

User invites

• Get user invite: GET /api/v2/user-invites/{userInviteId}
• Delete user invite: DELETE /api/v2/user-invites/{userInviteId}
• Resend user invite (by email): POST /api/v2/user-invites/{userInviteId}/resend

Device invites

• Get device invite: GET /api/v2/device-invites/{deviceInviteId}
• Delete device invite: DELETE /api/v2/device-invites/{deviceInviteId}
• Resend device invite (by email): POST /api/v2/device-invites/{deviceInviteId}/resend
• Accept device invite POST /api/v2/device-invites/-/accept