From 2bfa772f5991f729b8d6076c9f8fc574b10cff92 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 21 Jun 2026 11:35:59 +0000
Subject: [PATCH] feat(asm): complete Tags resource with GET, PATCH, and DELETE
 endpoints

The Tags resource was missing single-resource operations that every other
resource (Assets, Vulnerabilities) already exposes. Adds GET /tags/{tag_id},
PATCH /tags/{tag_id}, and DELETE /tags/{tag_id}, plus the TagId path
parameter, TagUpdate request schema, and descriptions on listTags/createTag.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NiDvq31B2krChD32LkopDV
---
 asm/openapi.yaml | 79 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)

diff --git a/asm/openapi.yaml b/asm/openapi.yaml
index 228f34f..12d109a 100644
--- a/asm/openapi.yaml
+++ b/asm/openapi.yaml
@@ -347,6 +347,7 @@ paths:
     get:
       operationId: listTags
       summary: List tags
+      description: Returns all tags defined in the tenant.
       tags: [Tags]
       responses:
         '200':
@@ -365,6 +366,7 @@ paths:
     post:
       operationId: createTag
       summary: Create tag
+      description: Creates a new tag that can be applied to assets.
       tags: [Tags]
       requestBody:
         required: true
@@ -393,6 +395,64 @@ paths:
         '401':
           $ref: '#/components/responses/Unauthorized'
 
+  /tags/{tag_id}:
+    parameters:
+      - $ref: '#/components/parameters/TagId'
+    get:
+      operationId: getTag
+      summary: Get tag
+      description: Returns a single tag by ID.
+      tags: [Tags]
+      responses:
+        '200':
+          description: Tag detail
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+    patch:
+      operationId: updateTag
+      summary: Update tag
+      description: Update the name or color of a tag.
+      tags: [Tags]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TagUpdate'
+      responses:
+        '200':
+          description: Updated tag
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+    delete:
+      operationId: deleteTag
+      summary: Delete tag
+      description: |
+        Permanently deletes a tag and removes it from all assets it was
+        applied to. This action cannot be undone.
+      tags: [Tags]
+      responses:
+        '204':
+          description: Tag deleted
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
 components:
   securitySchemes:
     bearerAuth:
@@ -426,6 +486,14 @@ components:
         type: string
         pattern: '^ast_[a-z0-9]{16}$'
       example: ast_1a2b3c4d5e6f0001
+    TagId:
+      name: tag_id
+      in: path
+      required: true
+      schema:
+        type: string
+        pattern: '^tag_[a-z0-9]{16}$'
+      example: tag_0001aabbccdd0001
 
   responses:
     Unauthorized:
@@ -548,6 +616,17 @@ components:
           format: date-time
           readOnly: true
 
+    TagUpdate:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 64
+        color:
+          type: string
+          pattern: '^#[0-9a-fA-F]{6}$'
+          example: '#e63946'
+
     # ── Assets ─────────────────────────────────────────────────────────────────
 
     Asset: