Skip to main content
Prisma Browser

Application tags

An application tag is a free-form label you define and attach to applications for your own grouping and reporting. A tag carries nothing but an ID and a name: it holds no settings of its own. Tags are a visibility feature today, so attaching one to an application does not change what the Prisma Browser allows or blocks. Use tags to slice your application inventory along dimensions policy does not model, for example ownership, compliance scope, or migration status.

Tags are managed here, but attached on the application: you create the tag with this API, then send its ID in tagIDs when you create or update an application (see Tags and classification), or attach it to many applications at once with bulk update. You can tag every application type, including the catalog types (catalog and localdesktopcatalog).

note

The tag endpoints are in preview. Send -H "x-prisma-browser-preview: application-tags" on every call to /applications/tags. Without it the API returns 400. Attaching tags on the application and filtering applications by tag do not need the header. See Preview features.

On this page: what you can and cannot do, object model, limits, retrieve, create, update, delete, bulk update, find applications by tag, endpoint reference, tips, examples.

What you can and cannot do​

OperationSupported?How
List tagsYesGET /applications/tags, with name search, sorting, and pagination
Read one tagYesGET /applications/tags/{id}
Create a tagYesPOST /applications/tags
Rename a tagYesPUT /applications/tags/{id}
Delete a tagYesDELETE /applications/tags/{id}, only when no application carries it
Attach a tag to an applicationYes, on the applicationSend tagIDs on the application create or PATCH
Add or remove tags, or set classification, on many applicationsYesPOST /applications/tags/bulk-update, up to 500 applications per call
Find the applications that carry a tagYestagId or tagName filter on GET /applications
Tag any application type, including catalog and localdesktopcatalogYestagIDs on create (the four types you create) or on PATCH (all six types), or bulk update
Create, rename, or delete tags in bulkNoLoop over single calls

Tags are part of the draft. A tag you create is not in the active configuration until you publish.

Object model​

A tag is two fields:

FieldTypeRequiredNotes
idstringread-onlyAssigned on create. 0TG followed by 26 digits and uppercase letters (never I, L, O, or U)
namestringyes1 to 127 characters. Unique across the tenant
{
  "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX",
  "name": "Finance approved"
}

An application returns its tags as the same objects, under tags:

"tags": [
  { "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX", "name": "Finance approved" },
  { "id": "0TG01PC11NSC0PEXXXXXXXXXXXXXX", "name": "PCI in scope" }
]

Because the application stores the tag by ID, renaming a tag updates every application that carries it. You never have to touch the applications to change a label.

Limits​

LimitValue
name length1 to 127 characters
Tags per application63
Applications per bulk update500
Tags per tenantSee Entity limits

Retrieve​

List and filter​

Supports name search, sort and order, and pagination (limit / cursor).

GET /seb-api/v1/applications/tags
curl -sS -G "$PB_API_BASE/applications/tags" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  --data-urlencode "name=finance" \
  --data-urlencode "sort=tag.name" \
  --data-urlencode "order=asc" \
  --data-urlencode "limit=50"

Response (200):

{
  "data": [
    {
      "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX",
      "name": "Finance approved"
    },
    {
      "id": "0TG01F1NANCEREV1EWXXXXXXXXXXX",
      "name": "Finance review"
    }
  ],
  "pageInfo": {
    "hasNextPage": false,
    "cursor": "gaFpvTBURzAxTTQzRVJGRjBXVFlB",
    "totalCount": 2
  }
}
ParameterNotes
nameMatches tags whose name contains this value
sorttag.name or tag.id
orderasc or desc
limitMaximum number of tags to return, 1 or more
cursorOpaque string from pageInfo.cursor; pass it to read the next page
configurationVersiondraft (the default) or active
includeTotalCountpageInfo.totalCount is on the first page by default. true returns it on every page, false omits it

Page through with pageInfo.hasNextPage and pageInfo.cursor, as described in Pagination.

Get one​

GET /seb-api/v1/applications/tags/{id}
curl -sS "$PB_API_BASE/applications/tags/$TAG_ID" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags"

Response (200):

{
  "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX",
  "name": "Finance approved"
}

A tag that exists in the draft but has not been published yet returns 404 when you ask for the active version with configurationVersion=active.

Create​

name is the only field, and it must be unique across the tenant.

POST /seb-api/v1/applications/tags
curl -sS -X POST "$PB_API_BASE/applications/tags" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Finance approved" }'

Returns 201 Created with the new tag ID. Capture it for later snippets:

export TAG_ID='0TG01F1NANCEAPPR0VEDXXXXXXXXX'

A name that already exists returns 409. A name shorter than 1 or longer than 127 characters returns 400.

Remember: this edits the draft. Publish to make it live (see Draft and publish). With partial publish you can publish just this tag.

Update​

PUT renames the tag. name is the only field you can change, and it is required on every call.

PUT /seb-api/v1/applications/tags/{id}
curl -sS -X PUT "$PB_API_BASE/applications/tags/$TAG_ID" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Finance approved 2026" }'

Response (200):

{ "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX" }

The new name is returned by every application that carries the tag, with no further calls. Renaming to a name another tag already uses returns 409.

note

Attaching and detaching happen on the application, not here. To change which applications carry a tag, send tagIDs on the application. The delta form adds and removes specific tags without re-sending the whole set: "tagIDs": { "add": [ "0TG..." ], "remove": [ "0TG..." ] }. See Tags and classification.

Delete​

DELETE /seb-api/v1/applications/tags/{id}
curl -sS -X DELETE "$PB_API_BASE/applications/tags/$TAG_ID" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags"

Returns 204 with an empty body.

A tag that is still attached to at least one application returns 409 and is not deleted. Detach it from every application first, then delete it.

Bulk update​

Add or remove tags, or set the classification, on up to 500 applications in one call. The update is atomic: either every application is updated or none is.

POST /seb-api/v1/applications/tags/bulk-update
curl -sS -X POST "$PB_API_BASE/applications/tags/bulk-update" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  -H "Content-Type: application/json" \
  -d '{
        "applicationIds": [ "0AP01ACMEW1K1XXXXXXXXXXXXXXXX", "0AP01HRP0RTA1XXXXXXXXXXXXXXXX" ],
        "addTagIds": [ "0TG01PC11NSC0PEXXXXXXXXXXXXXX" ],
        "removeTagIds": [ "0TG01PEND1NGREV1EWXXXXXXXXXXX" ],
        "classification": "Sanctioned"
      }'

Returns 204 with an empty body.

FieldRequiredNotes
applicationIdsyes1 to 500 unique application IDs
addTagIdsnoTag IDs to attach to every listed application
removeTagIdsnoTag IDs to detach from every listed application
classificationnoSanctioned, Tolerated, Unsanctioned, or Unclassified, set on every listed application

Send at least one of addTagIds, removeTagIds, or classification. A tag ID cannot appear in both addTagIds and removeTagIds in the same request.

Remember: this edits the draft. Publish to make it live.

Find applications by tag​

Filter the applications list by tag ID or by tag name. Both filters take a comma-separated list and return applications that carry any of the values. tagId and tagName cannot be combined in one request. tagName is case-sensitive. These filters are on the applications endpoints, so they do not need the preview header.

curl -sS -G "$PB_API_BASE/applications" \
  -H "Authorization: Bearer $PB_TOKEN" \
  --data-urlencode "tagName=PCI in scope,Finance approved" \
  --data-urlencode "limit=100"

The same filters work on GET /applications/type/{type}. Add classification (also comma-separated) to narrow the result to one or more classifications. See Applications.

Endpoint reference​

MethodPathPurpose
GET/applications/tagsList tags (search, sort, paginate)
GET/applications/tags/{id}Read one tag
POST/applications/tagsCreate one tag
PUT/applications/tags/{id}Rename one tag
DELETE/applications/tags/{id}Delete one tag
POST/applications/tags/bulk-updateAdd or remove tags, or set classification, on up to 500 applications

All paths are under the /seb-api/v1 base. Every path in this table needs x-prisma-browser-preview: application-tags.

Tips and gotchas​

note

Tags are a visibility feature today. Tags and classification help you review your application inventory: filter and group applications by your own labels on the Application Usage page in Strata Cloud Manager when you assess what is in use and who owns it. Rules do not match on tags yet, so attaching one does not change enforcement. Using tags and classification in policy is planned for a future release. To act on a set of applications in policy today, use an application group.

note

Tags and classification are different fields. classification records how your organization treats an application (Sanctioned, Tolerated, Unsanctioned, Unclassified) and is stored separately. A tag is never returned in classification and a classification is never returned in tags, so never model classification as a tag named Sanctioned. See Tags and classification.

caution

Delete is blocked while the tag is in use. DELETE returns 409 if any application still carries the tag. There is no cascade and no force flag, so to retire a label, find the applications that carry it with the tagId filter, detach it with one bulk update (removeTagIds), then delete the tag.

note

Rename instead of recreating. Applications reference the tag by ID, so renaming keeps every attachment intact. Deleting and recreating gives you a new ID and detaches the tag from every application.

Examples​

Seed a taxonomy, then publish once

Create several tags, then publish a single time so the whole set goes live together.

for NAME in "Finance approved" "PCI in scope" "Pending review"; do
  curl -sS -X POST "$PB_API_BASE/applications/tags" \
    -H "Authorization: Bearer $PB_TOKEN" \
    -H "x-prisma-browser-preview: application-tags" \
    -H "Content-Type: application/json" \
    -d "{ \"name\": \"$NAME\" }"
done

Each call returns 201 with the new tag ID. Publish once when the loop finishes (see Draft and publish).

Find a tag ID by name

Search by name instead of listing every tag.

curl -sS -G "$PB_API_BASE/applications/tags" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  --data-urlencode "name=PCI" \
  --data-urlencode "limit=10"

Response (200):

{
  "data": [
    {
      "id": "0TG01PC11NSC0PEXXXXXXXXXXXXXX",
      "name": "PCI in scope"
    }
  ],
  "pageInfo": {
    "hasNextPage": false,
    "cursor": "gaFpvTBURzAxTTQzRVJGRjBXVFlB",
    "totalCount": 1
  }
}
Create a tag and attach it to a new application

Create the tag, capture its ID, then reference it in tagIDs on the application.

curl -sS -X POST "$PB_API_BASE/applications/tags" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Finance approved" }'

Returns 201 with the new tag ID:

export TAG_ID='0TG01F1NANCEAPPR0VEDXXXXXXXXX'
curl -sS -X POST "$PB_API_BASE/applications/type/custom" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "Acme Wiki",
        "type": "custom",
        "urls": [ { "url": "wiki.acme.example.com" } ],
        "tagIDs": [ "0TG01F1NANCEAPPR0VEDXXXXXXXXX" ]
      }'

Returns 201 with the new application ID.

Retire a tag that is still in use

Find the applications that carry the tag, detach it from all of them in one bulk update, then delete it.

curl -sS -G "$PB_API_BASE/applications" \
  -H "Authorization: Bearer $PB_TOKEN" \
  --data-urlencode "tagId=$TAG_ID" \
  --data-urlencode "limit=500"

Collect the id of each application in data, then detach the tag:

curl -sS -X POST "$PB_API_BASE/applications/tags/bulk-update" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags" \
  -H "Content-Type: application/json" \
  -d '{
        "applicationIds": [ "0AP01ACMEW1K1XXXXXXXXXXXXXXXX" ],
        "removeTagIds": [ "0TG01F1NANCEAPPR0VEDXXXXXXXXX" ]
      }'
curl -sS -X DELETE "$PB_API_BASE/applications/tags/$TAG_ID" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "x-prisma-browser-preview: application-tags"

Returns 204. Deleting before you detach returns 409. If more than 500 applications carry the tag, page through the list and send one bulk update per 500 applications.

Previous
Application groups
Next
User groups