Health check: device counts, online/offline, key expiry warnings, updates, tailnet settings, write gate.

List all devices: hostname, OS, IP, online/offline, key expiry, tags, update status.

Optional scope arg filters devices by DD-278 scope-tag mapping (configurable via TAILSCALE_SCOPE_{INFRASTRUCTURE,PERSONAL,HOME}_TAGS). Output includes a Track 3 _meta envelope as a JSON tail line.

Full detail for a single device: addresses, OS, client version, key status, tags, user.

Single-record fetch — server-side filter is device_id-shaped, not tag-shaped. The _meta envelope is emitted for audit-surface uniformity; scope= is intentionally NOT accepted here because a scope filter on a single-device-detail call is semantically incoherent.

Routes for a device: advertised subnets, approved/unapproved status.

Emits a DD-338 _meta envelope (audit_surface: structured) disclosing the device_id= server-side discrimination + the routes-row cardinality (advertised + enabled, union).

DNS configuration: nameservers, MagicDNS status, search paths, split DNS rules.

ACL policy summary: groups, rules, SSH rules, tag owners. Shows who can talk to whom.

Validate an ACL policy without applying it. Returns errors or 'passed'.

Apply (POST) a full ACL policy to the tailnet. Requires TAILSCALE_WRITE_ENABLED=true.

Always validates the policy first and refuses to apply on validation failure. By default uses optimistic concurrency: the current ETag is sent as If-Match so a concurrent admin edit fails with a clear re-fetch message instead of silently clobbering. Pass allow_overwrite_concurrent=true to bypass the guard. Requires a token with ACL policy-file WRITE scope (a read-only key 403s). Emits a DD-338 _meta envelope (audit_surface: structured).

List auth keys: ID, description, reusable/ephemeral/preauth flags, tags, expiry.

Optional scope arg filters keys by DD-278 scope-tag mapping. Output includes a Track 3 _meta envelope as a JSON tail line.

List users: name, login, role, status, device count, online/last seen. Sorted by case-folded loginName ascending (numeric id tie-break).

List configured webhooks: endpoint URL, event subscriptions, created date. Sorted by endpointId ascending.

Configuration audit log: who changed what, when. Recent entries first.

Optional scope arg filters audit entries to those whose target is a device with a tag in the scope set. Requires a secondary fetch of the device-tag map (uncached at v1). Entries with non-device targets are excluded when scope is provided.

Authorize or deauthorize a device. Requires TAILSCALE_WRITE_ENABLED=true.

Set ACL tags on a device. Replaces existing tags. Requires TAILSCALE_WRITE_ENABLED=true.

Force key expiry on a device — it must re-authenticate. Requires TAILSCALE_WRITE_ENABLED=true.

Approve subnet routes on a device. Requires TAILSCALE_WRITE_ENABLED=true.

Default (replace=false): additive — reads the device's currently enabled routes first and approves the union, so previously approved routes are preserved.

replace=true: raw Tailscale set-routes REPLACE semantics — the enabled set becomes exactly routes; any currently enabled route not listed is de-approved, which can sever subnet connectivity. Use only when you intend to remove approvals.

Create a new auth key. Requires TAILSCALE_WRITE_ENABLED=true.

Revoke an auth key. Requires TAILSCALE_WRITE_ENABLED=true and confirm=true.

Delete a device from the tailnet. Requires TAILSCALE_WRITE_ENABLED=true and confirm=true.