Documented steps

Get a token with OAuth scope webhooks (write); requester must be Owner, Admin, Network admin, or IT admin.
POST https://api.tailscale.com/api/v2/tailnet/{tailnet}/webhooks with body: endpointUrl (required, HTTPS) and subscriptions (required array of event names, e.g. ["nodeCreated", "userDeleted"]); optional providerType (slack | mattermost | googlechat | discord) to auto-format payloads.
Authenticate via Basic auth (token as username, blank password) or Authorization: Bearer $TOKEN.
Response 200: a Webhook object with endpointId, subscriptions, and secret — the signing secret used to verify the Tailscale-Webhook-Signature header on deliveries. Store it immediately.
Verify delivery: POST https://api.tailscale.com/api/v2/webhooks/{endpointId}/test — returns 202 and asynchronously sends an event of type 'test' to your endpoint.
Manage later: PATCH https://api.tailscale.com/api/v2/webhooks/{endpointId} (change subscriptions), POST .../rotate (rotate secret), DELETE .../{endpointId} (remove).
Official docs: https://tailscale.com/kb/1213/webhooks and the OpenAPI spec at https://api.tailscale.com/api/v2?outputOpenapiSchema=true.

Known gotchas

The secret field is only populated at creation or after a rotate call — it cannot be re-fetched later.
The endpoint URL must use HTTPS.
The webhookDeleted event is subscribed by default on every webhook and cannot be disabled.
nodeAuthorized and nodeNeedsAuthorization events are deprecated in favor of nodeApproved/nodeNeedsApproval, but endpoints keep receiving the deprecated events until explicitly unsubscribed.
Preauthorized devices never trigger nodeApproved since they skip the approval step.

Related routes

Implement Increase webhook event subscription, signature verification, and cursor-based event polling as a delivery backstop

banking-general · 6 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Create a Tailscale webhook endpoint subscribed to tailnet events via the API, then send a test event to verify delivery.

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 15,500+ more routes

Need this verified for your stack — or a route we don't have yet?