Delete tailnet
tailscale_delete_tailnetPermanently delete a Tailscale tailnet and all its devices, users, ACLs, and keys. Use it to tear down an API-only tailnet, with confirmTailnet as a typo guard.
Instructions
Permanently delete a tailnet. This is IRREVERSIBLE and removes every device, user, ACL, and key in it.
By default it acts on the tailnet the current credentials point at (TAILSCALE_TAILNET, or TAILSCALE_OAUTH_TAILNET when targeting an API-only tailnet). Pass tailnet to name a different one -- e.g. an id returned by tailscale_list_org_tailnets -- which requires credentials scoped to reach it; UNVERIFIED against a live tailnet, so expect a 403/404 if your token cannot. You must always pass confirmTailnet matching the effective target exactly; the call is refused locally otherwise. That check is a typo guard, not an authorization gate: when you also pass tailnet you are supplying both halves of the comparison, so it proves only that they agree -- it is a genuine second look only on the omit-tailnet path, where the value has to match the operator's environment. Restricting who may delete at all is TAILSCALE_READONLY / TAILSCALE_TOOLS, which drop this tool from the server entirely. Intended for tearing down API-only tailnets created by tailscale_create_org_tailnet.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tailnet | No | Tailnet to delete (e.g. an id from tailscale_list_org_tailnets). Omit to target the configured tailnet. Requires credentials scoped to reach it. | |
| confirmTailnet | Yes | Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A typo guard, not an authorization gate: on the explicit-`tailnet` path the caller writes both halves of the comparison, so it proves only self-agreement. It is a real second look only when `tailnet` is omitted and the value has to match the operator's environment. |