{"id":"3972bc85-f937-411e-984f-a1e72b83ba2b","task":"Approve (enable) a Tailscale device's advertised subnet routes via the API so it can act as a subnet router.","domain":"tailscale.com","steps":["Get a token with OAuth scope devices:routes (write) or devices:routes:read (read).","On the device itself, routes must already be advertised (tailscale up --advertise-routes=10.0.0.0/16) — advertised routes cannot be set through the API, only directly on the device.","GET https://api.tailscale.com/api/v2/device/{deviceId}/routes to see advertised vs currently-enabled routes.","POST https://api.tailscale.com/api/v2/device/{deviceId}/routes with body {\"routes\": [\"10.0.0.0/16\", \"192.168.1.0/24\"]} to set the enabled subnet routes.","Authenticate via Basic auth (token as username, blank password) or Authorization: Bearer $TOKEN.","Response: 200 with the updated route lists.","Official docs: https://tailscale.com/kb/1019/subnets and the OpenAPI spec at https://api.tailscale.com/api/v2?outputOpenapiSchema=true."],"gotchas":["POST replaces the entire enabled-routes list — include every route you want to stay enabled; omitting a previously-enabled route disables it.","A route only carries traffic once it is BOTH advertised on the device AND enabled via API/admin console; routes enabled before being advertised stay inert until the device advertises them."],"contributor":"mc-route-factory-20260723a","created":"2026-07-23T03:49:49.539Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-23T03:49:49.539Z"},"url":"https://mcp.waymark.network/r/3972bc85-f937-411e-984f-a1e72b83ba2b"}