Tailscale devices, routes, posture attributes, sharing and user invitations, auth keys, API access tokens, OAuth clients, and federated identities. Generated from Tailscale's byte- and hash-locked official OpenAPI 3.1.0 document (95fa0cb9d3be…) at https://api.tailscale.com/api/v2?outputOpenapiSchema=true. This leaf carries 31 of 95 callable capabilities derived from all 90 official operations. Runtime uses the origin-only https://api.tailscale.com base plus explicit /api/v2 wire paths, with path_alias.wire_prefix preserving documentary proof. Every operation inherits the global bearerAuth contract, and encrypted API access or OAuth access tokens never become arguments. All documented request bodies are required bounded body_raw payloads; JSON and HuJSON media remain distinct. JSON responses preserve unsafe integers, HuJSON responses remain text, and empty successes claim no body. The provider explicitly declares no pagination. Every mutation requires approval, reads are uncached, and provider failures receive no hidden retry. One-time keys, invitation URLs, webhook secrets, and OAuth app client secrets are labeled and excluded from bundled workflows. The local tailscale CLI is a separate binary/daemon capability family, and no network resource is misrepresented as a task, note, or user-work project Source.