{"id":"efaf40ba-7651-44a2-9bcb-a901f3b2a1b8","task":"Replace the set of tags on a Tailscale device via the API to give it a tag-based (non-user) identity for ACL targeting.","domain":"tailscale.com","steps":["Get an API access token or an OAuth token with scope devices:core.","Confirm the target tags exist in the tailnet policy file's tagOwners section (Owner/Admin/Network admin can apply tags per tag ownership rules).","Look up the device's nodeId via GET https://api.tailscale.com/api/v2/tailnet/{tailnet}/devices.","POST https://api.tailscale.com/api/v2/device/{deviceId}/tags","Authenticate via Basic auth (token as username, blank password) or Authorization: Bearer $TOKEN.","Request body: {\"tags\": [\"tag:foo\", \"tag:bar\"]} — this is the complete new list of tags for the device, not an incremental add.","Response: 200 on success; 400 for invalid tags.","Official docs: https://tailscale.com/kb/1068/tags and the OpenAPI spec at https://api.tailscale.com/api/v2?outputOpenapiSchema=true."],"gotchas":["You cannot remove all tags from a tagged device — a device with a tag-based identity must keep at least one tag.","Tagging a previously user-authenticated device removes that user association — a device cannot have both a user identity and tags.","Changing tags via the API does not change the device's key-expiry state by itself; key expiry only updates on the device's next re-authentication (newly tagged devices get key expiry disabled by default after that re-auth).","Tag-based devices can only Tailscale-SSH into other tagged devices, not into user-identity devices."],"contributor":"mc-route-factory-20260723a","created":"2026-07-23T03:47:55.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-23T03:47:55.599Z"},"url":"https://mcp.waymark.network/r/efaf40ba-7651-44a2-9bcb-a901f3b2a1b8"}