One-install Tailscale API front door over three bounded domain packs and 14 non-chat, uncached read workflows. It admits all 90 official operations across 58 paths and adds 5 explicit policy details/HuJSON media variants, for 95 callable capabilities. Tailscale calls its endpoints stable but its generated OpenAPI unstable, so generation byte- and hash-locks the live first-party document. Runtime calls use the origin-only https://api.tailscale.com base plus explicit /api/v2 paths, reconciled by path_alias.wire_prefix. Every operation inherits the global bearerAuth contract; users can enroll a personal API access token or a short-lived scoped OAuth access token. All body-bearing operations require bounded verbatim JSON or HuJSON payloads, repairing thirty-one omitted requestBody.required markers. Policy details, JSON, and HuJSON modes are separated so the forbidden details-plus-Accept combination cannot be emitted. JSON integers remain exact, empty responses claim no body, and the provider's explicit no-pagination contract is preserved. One-time keys, invite URLs, webhook secrets, OAuth app client secrets, and third-party credential bodies are labeled and excluded from bundled workflows. Every mutation requires approval; reads are uncached and provider failures are never silently retried. The local tailscale CLI and tailscaled daemon remain a separate future pack rather than an implicit runtime prerequisite. No work-entity Source is claimed.