diff --git a/asm/openapi.yaml b/asm/openapi.yaml
index 228f34f..2f65515 100644
--- a/asm/openapi.yaml
+++ b/asm/openapi.yaml
@@ -393,6 +393,72 @@ paths:
         '401':
           $ref: '#/components/responses/Unauthorized'
 
+  /tags/{tag_id}:
+    parameters:
+      - $ref: '#/components/parameters/TagId'
+    get:
+      operationId: getTag
+      summary: Get tag
+      description: Returns a single tag by ID.
+      tags: [Tags]
+      responses:
+        '200':
+          description: Tag detail
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+    patch:
+      operationId: updateTag
+      summary: Update tag
+      description: Update a tag's name or color.
+      tags: [Tags]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                name:
+                  type: string
+                  maxLength: 64
+                color:
+                  type: string
+                  pattern: '^#[0-9a-fA-F]{6}$'
+                  example: '#e63946'
+      responses:
+        '200':
+          description: Updated tag
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+    delete:
+      operationId: deleteTag
+      summary: Delete tag
+      description: |
+        Permanently deletes a tag and removes it from all assets it is currently
+        applied to. This action cannot be undone.
+      tags: [Tags]
+      responses:
+        '204':
+          description: Tag deleted
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
 components:
   securitySchemes:
     bearerAuth:
@@ -426,6 +492,14 @@ components:
         type: string
         pattern: '^ast_[a-z0-9]{16}$'
       example: ast_1a2b3c4d5e6f0001
+    TagId:
+      name: tag_id
+      in: path
+      required: true
+      schema:
+        type: string
+        pattern: '^tag_[a-z0-9]{16}$'
+      example: tag_0001aabbccdd0001
 
   responses:
     Unauthorized: