Tailscale audit and flow logs, log streaming, users, contacts, webhooks, tailnet settings, and user-delegated OAuth apps. Generated from Tailscale's byte- and hash-locked official OpenAPI 3.1.0 document (95fa0cb9d3be…) at https://api.tailscale.com/api/v2?outputOpenapiSchema=true. This leaf carries 32 of 95 callable capabilities derived from all 90 official operations. Runtime uses the origin-only https://api.tailscale.com base plus explicit /api/v2 wire paths, with path_alias.wire_prefix preserving documentary proof. Every operation inherits the global bearerAuth contract, and encrypted API access or OAuth access tokens never become arguments. All documented request bodies are required bounded body_raw payloads; JSON and HuJSON media remain distinct. JSON responses preserve unsafe integers, HuJSON responses remain text, and empty successes claim no body. The provider explicitly declares no pagination. Every mutation requires approval, reads are uncached, and provider failures receive no hidden retry. One-time keys, invitation URLs, webhook secrets, and OAuth app client secrets are labeled and excluded from bundled workflows. The local tailscale CLI is a separate binary/daemon capability family, and no network resource is misrepresented as a task, note, or user-work project Source.