generated: '2026-07-15' method: generated source: openapi/tailscale-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 45 by_action_class: connected: 19 acting: 26 by_consequence: read: 19 write: 24 physical: 2 human_in_the_loop_required: 0 operations: - path: /tailnet/{tailnet}/devices method: get operationId: listTailnetDevices x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/device-attributes method: get operationId: listTailnetDeviceAttributes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /device/{deviceId} method: get operationId: getDevice x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /device/{deviceId} method: delete operationId: deleteDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/expire method: post operationId: expireDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/routes method: get operationId: getDeviceRoutes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /device/{deviceId}/routes method: post operationId: setDeviceRoutes x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/authorized method: post operationId: authorizeDevice x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/name method: post operationId: setDeviceName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/tags method: post operationId: setDeviceTags x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/key method: post operationId: setDeviceKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/ip method: post operationId: setDeviceIp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/attributes method: get operationId: getDeviceAttributes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /device/{deviceId}/attributes/{attributeKey} method: post operationId: setDeviceAttribute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/attributes/{attributeKey} method: delete operationId: deleteDeviceAttribute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device/{deviceId}/device-invites method: get operationId: listDeviceInvitesForDevice x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /device/{deviceId}/device-invites method: post operationId: createDeviceInvite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/user-invites method: get operationId: listUserInvites x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/user-invites method: post operationId: createUserInvite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /user-invites/{userInviteId} method: get operationId: getUserInvite x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user-invites/{userInviteId} method: delete operationId: deleteUserInvite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /user-invites/{userInviteId}/resend method: post operationId: resendUserInvite x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device-invites/{deviceInviteId} method: get operationId: getDeviceInvite x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /device-invites/{deviceInviteId} method: delete operationId: deleteDeviceInvite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device-invites/{deviceInviteId}/resend method: post operationId: resendDeviceInvite x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /device-invites/-/accept method: post operationId: acceptDeviceInvite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/logging/configuration method: get operationId: getConfigurationLog x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/logging/network method: get operationId: getNetworkLog x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/logging/{logType}/stream method: get operationId: getLogStream x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/logging/{logType}/stream method: post operationId: setLogStream x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/logging/{logType}/stream method: delete operationId: deleteLogStream x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/logging/{logType}/stream/status method: get operationId: getLogStreamStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/dns/nameservers method: get operationId: getDnsNameservers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/dns/nameservers method: post operationId: setDnsNameservers x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/dns/preferences method: get operationId: getDnsPreferences x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/dns/preferences method: post operationId: setDnsPreferences x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/dns/searchpaths method: get operationId: getDnsSearchPaths x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/dns/searchpaths method: post operationId: setDnsSearchPaths x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/acl method: get operationId: getAclPolicy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/acl method: post operationId: setAclPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/acl/validate method: post operationId: validateAclPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/keys method: get operationId: listKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/keys method: post operationId: createKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tailnet/{tailnet}/keys/{keyId} method: get operationId: getKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tailnet/{tailnet}/keys/{keyId} method: delete operationId: deleteKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required