> ## Documentation Index
> Fetch the complete documentation index at: https://docs.melso.ai/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Melso product MCP: https://melso.ai/api/mcp (OAuth; one company per grant). REST: https://melso.ai. Documentation-search MCP: https://docs.melso.ai/mcp. The docs search server does not act on customer accounts.
>
> Use the live tool schema and respect company membership. Ask the person to authorize the exact fiscal document version in the signed-in app. A professional prepares and files included returns after authorization; AI does not file alone. A prepared file or approval receipt is not evidence of filing. Never claim completion from an accepted Task or Run. Keep credentials out of chat and logs. Agents features are internal or by private invitation.
# Put workspace private network
> Workspace owner/admin (a person), or an admin API key. `configured_by` is then the key's identity.
Request: For Tailscale: `provider:"tailscale"`, `client_id:string`, `client_secret?:string` (starts with `tskey-client-`), `tags:string[]` (1–20 tags, each matching `tag:[a-zA-Z][a-zA-Z0-9-]*`), `accept_routes?:boolean`, `accept_dns?:boolean`, `enabled?:boolean`. For Headscale: `provider:"headscale"`, `login_server:string` (an `https://` origin with no path, credentials, query or fragment), `auth_key?:string` (20–512 characters, no whitespace), `accept_routes?:boolean`, `accept_dns?:boolean`, `enabled?:boolean`. Leaving out `client_secret` or `auth_key` keeps the stored one while the provider stays the same; switching provider needs a new one. A left-out switch keeps its saved value, and is on for a new network. Every save increments `generation`.
Response: The `GET` shape.
Status: 200; 400 `private_network_invalid` (a field failed validation; `error` names it); 403 `insufficient permissions` for a member who is not an owner or admin, `this endpoint is only available to human actors` for a credential that is neither a person's nor an admin API key, or `workspace_key_scope` for a `tasks` API key; 422 `private_network_rejected` (Tailscale refused the OAuth client, or could not be reached to check it; nothing changed); 503 when the server has no Secrets keyring to seal the secret. A Tailscale save that changes the provider, client ID, secret or tags is checked first: Melso mints a one-minute, single-use key for the tags with the OAuth client and deletes it at once. Saving the same credential again, for example to turn the network on or off, does not check it again. Authentication and resource-access errors follow [Overview](/api-reference/errors).
## OpenAPI
````yaml /api-reference/openapi.json put /api/workspaces/{id}/private-network
openapi: 3.1.0
info:
title: Melso API
version: '2026-10-12'
description: >-
Customer integration contracts for Melso. Agents access is internal or by
private invitation. Fiscal approval remains in the authenticated app.
contact:
name: Melso
url: https://melso.ai/en
servers:
- url: https://melso.ai
description: Production API origin
security: []
tags:
- name: Areas
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Areas operations available within the caller's documented permissions.
- name: Artifacts
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Artifacts operations available within the caller's documented permissions.
- name: Authentication
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Authentication operations available within the caller's documented
permissions.
- name: Automations
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Automations operations available within the caller's documented
permissions.
- name: Companies
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Companies operations available within the caller's documented permissions.
- name: Execution funding
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Execution funding operations available within the caller's documented
permissions.
- name: Files
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Files operations available within the caller's documented permissions.
- name: GitHub
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
GitHub operations available within the caller's documented permissions.
- name: Interactions
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Interactions operations available within the caller's documented
permissions.
- name: Knowledge
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Knowledge operations available within the caller's documented permissions.
- name: MCP
description: MCP operations available within the caller's documented permissions.
- name: Messages
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Messages operations available within the caller's documented permissions.
- name: OAuth
description: OAuth operations available within the caller's documented permissions.
- name: Private network
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Private network operations available within the caller's documented
permissions.
- name: Runs
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Runs operations available within the caller's documented permissions.
- name: Skills
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Skills operations available within the caller's documented permissions.
- name: Tasks
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Tasks operations available within the caller's documented permissions.
- name: Vault
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Vault operations available within the caller's documented permissions.
- name: Webhooks
description: >-
Melso Agents is available only internally or by private invitation.
Agents-specific features require existing access. For the autónomo fiscal
service, see [Get started](/essentials/quickstart).
Webhooks operations available within the caller's documented permissions.
paths:
/api/workspaces/{id}/private-network:
put:
tags:
- Private network
summary: Put workspace private network
description: >-
Workspace owner/admin (a person), or an admin API key. `configured_by`
is then the key's identity.
Request: For Tailscale: `provider:"tailscale"`, `client_id:string`,
`client_secret?:string` (starts with `tskey-client-`), `tags:string[]`
(1–20 tags, each matching `tag:[a-zA-Z][a-zA-Z0-9-]*`),
`accept_routes?:boolean`, `accept_dns?:boolean`, `enabled?:boolean`. For
Headscale: `provider:"headscale"`, `login_server:string` (an `https://`
origin with no path, credentials, query or fragment), `auth_key?:string`
(20–512 characters, no whitespace), `accept_routes?:boolean`,
`accept_dns?:boolean`, `enabled?:boolean`. Leaving out `client_secret`
or `auth_key` keeps the stored one while the provider stays the same;
switching provider needs a new one. A left-out switch keeps its saved
value, and is on for a new network. Every save increments `generation`.
Response: The `GET` shape.
Status: 200; 400 `private_network_invalid` (a field failed validation;
`error` names it); 403 `insufficient permissions` for a member who is
not an owner or admin, `this endpoint is only available to human actors`
for a credential that is neither a person's nor an admin API key, or
`workspace_key_scope` for a `tasks` API key; 422
`private_network_rejected` (Tailscale refused the OAuth client, or could
not be reached to check it; nothing changed); 503 when the server has no
Secrets keyring to seal the secret. A Tailscale save that changes the
provider, client ID, secret or tags is checked first: Melso mints a
one-minute, single-use key for the tags with the OAuth client and
deletes it at once. Saving the same credential again, for example to
turn the network on or off, does not check it again. Authentication and
resource-access errors follow [Overview](/api-reference/errors).
operationId: putWorkspacePrivateNetwork
parameters:
- name: id
in: path
required: true
description: id from the corresponding authorized response.
schema:
type: string
- name: X-Workspace-ID
in: header
required: false
description: >-
Company UUID for a personal token on company-scoped operations. A
company API key already binds its company.
schema:
type: string
format: uuid
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateInput'
responses:
'200':
description: The `GET` shape.
content:
application/json:
schema:
$ref: '#/components/schemas/privateNetworkResponse'
'400':
description: Invalid request.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Authentication required.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Credential, company or resource access denied.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Resource unavailable to this caller.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'422':
description: Request failed; see the operation contract for the condition.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited; respect Retry-After when present.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'500':
description: Server error.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'503':
description: Request failed; see the operation contract for the condition.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearerAuth: []
components:
schemas:
UpdateInput:
type: object
properties:
provider:
type: string
client_id:
type: string
client_secret:
anyOf:
- type: string
- type: 'null'
tags:
type: array
items:
type: string
login_server:
type: string
auth_key:
anyOf:
- type: string
- type: 'null'
accept_routes:
anyOf:
- type: boolean
- type: 'null'
accept_dns:
anyOf:
- type: boolean
- type: 'null'
enabled:
anyOf:
- type: boolean
- type: 'null'
privateNetworkResponse:
type: object
properties:
private_network:
anyOf:
- $ref: '#/components/schemas/Settings'
- type: 'null'
required:
- private_network
Error:
type: object
properties:
error:
type: string
code:
type: string
required:
- error
additionalProperties: true
Settings:
type: object
properties:
provider:
type: string
enabled:
type: boolean
client_id:
type: string
tags:
type: array
items:
type: string
login_server:
type: string
accept_routes:
type: boolean
accept_dns:
type: boolean
generation:
type: integer
configured_by:
type: string
configured_at:
type: string
format: date-time
verified_at:
anyOf:
- type: string
format: date-time
- type: 'null'
last_error:
type: string
required:
- provider
- enabled
- client_id
- tags
- login_server
- accept_routes
- accept_dns
- generation
- configured_by
- configured_at
- verified_at
- last_error
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: >-
Company API key (mwk_) or personal access token (mel_). A PAT requires
X-Workspace-ID on company-scoped routes. An API key implies its own
company.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.