{"openapi":"3.1.0","info":{"title":"Tailscale (BYOK) API","version":"0.1.0","description":"Tailscale (BYOK) lets an AI assistant read your own Tailscale data through the Tailscale API with a key you supply (Tailscale API access token). Read-only: 12 tools (list_devices, get_device, get_device_routes, list_users, get_user, list_keys, get_key, get_contacts, get_dns_nameservers, get_dns_preferences, get_tailnet_settings, list_posture_integrations). The BYOK key travels with each request,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-tailscale.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-tailscale/docs"},"termsOfService":"https://connectorbay.com/byok-tailscale/terms"},"servers":[{"url":"https://byok-tailscale.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-tailscale/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_devices":{"post":{"operationId":"list_devices","summary":"List the devices of a tailnet with name, addresses, OS, client version, owner, tags, connection state and last seen time","description":"List the devices of a tailnet with name, addresses, OS, client version, owner, tags, connection state and last seen time. Use for \"Which devices are in my tailnet and which are offline\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"},"fields":{"anyOf":[{"enum":["default","all"],"type":"string"},{"type":"null"}],"default":"default","description":"Detail level: default, or all to add routes and connectivity data.","title":"Fields"}},"required":["tailnet"],"title":"list_devicesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_device":{"post":{"operationId":"get_device","summary":"Get one device: name, addresses, OS, client version, owner, tags, key expiry and connection state. Use for \"Show details","description":"Get one device: name, addresses, OS, client version, owner, tags, key expiry and connection state. Use for \"Show details of Tailscale device nodeid123CNTRL\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"device_id":{"description":"Device node id (the nodeId field, for example 'nodeid123CNTRL') or its legacy numeric id.","maxLength":200,"title":"Device Id","type":"string"},"fields":{"anyOf":[{"enum":["default","all"],"type":"string"},{"type":"null"}],"default":"default","description":"Detail level: default, or all to add routes and connectivity data.","title":"Fields"}},"required":["device_id"],"title":"get_deviceArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_device_routes":{"post":{"operationId":"get_device_routes","summary":"Get the subnet routes a device advertises and the ones that are enabled for it. Use for \"Which subnet routes does device","description":"Get the subnet routes a device advertises and the ones that are enabled for it. Use for \"Which subnet routes does device nodeid123CNTRL advertise\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"device_id":{"description":"Device node id (the nodeId field, for example 'nodeid123CNTRL') or its legacy numeric id.","maxLength":200,"title":"Device Id","type":"string"}},"required":["device_id"],"title":"get_device_routesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_users":{"post":{"operationId":"list_users","summary":"List the users of a tailnet with login name, role, type, status, device count and last seen time. Use for \"Who are the u","description":"List the users of a tailnet with login name, role, type, status, device count and last seen time. Use for \"Who are the users of my tailnet and what roles do they have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"},"type":{"anyOf":[{"enum":["member","shared"],"type":"string"},{"type":"null"}],"default":null,"description":"Only users of this type: member or shared.","title":"Type"},"role":{"anyOf":[{"enum":["owner","member","admin","it-admin","network-admin","billing-admin","auditor"],"type":"string"},{"type":"null"}],"default":null,"description":"Only users with this role.","title":"Role"}},"required":["tailnet"],"title":"list_usersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_user":{"post":{"operationId":"get_user","summary":"Get one tailnet user by id. Use for \"Show Tailscale user u123\".","description":"Get one tailnet user by id. Use for \"Show Tailscale user u123\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"user_id":{"description":"User id from list_users.","maxLength":200,"title":"User Id","type":"string"}},"required":["user_id"],"title":"get_userArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_keys":{"post":{"operationId":"list_keys","summary":"List the ids of the API access tokens, auth keys and OAuth clients of the tailnet (secret values are never listed). Use ","description":"List the ids of the API access tokens, auth keys and OAuth clients of the tailnet (secret values are never listed). Use for \"Which Tailscale keys exist in my tailnet\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"},"all":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"description":"True to list the keys of all users and the tailnet, false for only the key owner's keys.","title":"All"}},"required":["tailnet"],"title":"list_keysArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_key":{"post":{"operationId":"get_key","summary":"Get a key's metadata: type, description, created, expiry, revoked time, scopes and tags (the secret is not returned). Us","description":"Get a key's metadata: type, description, created, expiry, revoked time, scopes and tags (the secret is not returned). Use for \"When does Tailscale key k123 expire\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"},"key_id":{"description":"Key id from list_keys.","maxLength":200,"title":"Key Id","type":"string"}},"required":["tailnet","key_id"],"title":"get_keyArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_contacts":{"post":{"operationId":"get_contacts","summary":"Get the account, support and security contact email addresses of the tailnet and whether they are verified. Use for \"Wha","description":"Get the account, support and security contact email addresses of the tailnet and whether they are verified. Use for \"What contact emails does my tailnet have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"}},"required":["tailnet"],"title":"get_contactsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_dns_nameservers":{"post":{"operationId":"get_dns_nameservers","summary":"Get the global DNS nameservers set for the tailnet. Use for \"Which DNS nameservers does my tailnet use\".","description":"Get the global DNS nameservers set for the tailnet. Use for \"Which DNS nameservers does my tailnet use\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"}},"required":["tailnet"],"title":"get_dns_nameserversArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_dns_preferences":{"post":{"operationId":"get_dns_preferences","summary":"Get the tailnet DNS preferences, which tell whether MagicDNS is on. Use for \"Is MagicDNS enabled on my tailnet\".","description":"Get the tailnet DNS preferences, which tell whether MagicDNS is on. Use for \"Is MagicDNS enabled on my tailnet\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"}},"required":["tailnet"],"title":"get_dns_preferencesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_tailnet_settings":{"post":{"operationId":"get_tailnet_settings","summary":"Get the tailnet settings: device approval, key duration, user approval, flow logging, HTTPS and route selection. Use for","description":"Get the tailnet settings: device approval, key duration, user approval, flow logging, HTTPS and route selection. Use for \"What are my Tailscale tailnet settings\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"}},"required":["tailnet"],"title":"get_tailnet_settingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_posture_integrations":{"post":{"operationId":"list_posture_integrations","summary":"List the device posture integrations (provider and ids; no secrets) set up for the tailnet. Use for \"Which device postur","description":"List the device posture integrations (provider and ids; no secrets) set up for the tailnet. Use for \"Which device posture integrations does my tailnet use\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tailnet":{"description":"Tailnet name (for example 'example.com') or '-' for the default tailnet of the key.","maxLength":200,"title":"Tailnet","type":"string"}},"required":["tailnet"],"title":"list_posture_integrationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}