Use these APIs to define the tags Veza should treat as customer-defined properties. Access Reviews that involve these entity types will include columns showing the tag name and value.

For example, in AWS, you may automatically tag identities with a 3rd-party security tool, or use tags to label S3 buckets containing sensitive data. When a tag is promoted, Veza Access Reviews will treat the tag as a built-in entity attribute, and show this information for reviewers in an optional column.

• Promote tag

• Demote tag

• List tag promotions

Add a promotion rule by specifying its type and key, and the entity types it applies to:

• include_entity_types: if true, promote tags for the listed type(s).

• exclude_entity_type: if true, promotes tags for all entities except the listed type(s).

You can promote tags for any integration that supports them, such as Snowflake or Google Cloud. Use for integrations that do not support vendor-native tags or when built-in tagging is unavailable. Example tag types:

• AWSTag

• CookieTag (Veza Tag)

• GoogleCloudLabel

Entity types for tag promotion should be concrete types. You can confirm the format by viewing details for any graph node, and checking the Type attribute, for example:

• OAA.PagerDuty.User

• ActiveDirectoryUser

• OAA.custom_idp.IDPUser

Remove a promotion rule for the specified tag key and type. Demotions apply on the next data source parse.

Get all promotion rules for all entity types.

New in 2025.11.24: Bulk tagging operations are now available as part of the private/ API set.

Use these APIs to create, add, and remove Veza tags. These endpoints support bulk onboarding of external tags into Veza Access Graph, environment migrations, and maintaining Veza Tags at scale.

Methods

Create Veza Tag

Post {VezaURL}/api/v1/graph/tags

Define a new tag that can be applied to any discovered entity, as a key:value pair. The tag value is optional.

{
    "tag": {
        "key": "note",
        "value": "tags_can_be_used_as_searchable_properties,_or_add_extended_notes"
    }
}

A successful response will be empty ({}).

Post {VezaURL}/api/v1/graph/nodes/tags

Apply one or more tags to an entity by providing an entity ID. A new Tag will be created if one doesn't already exist.

To retrieve an entity ID, you can use the Query Builder API, or browse the Identity Data Entities catalog.

Post {VezaURL}/api/v1/graph/nodes/tags:remove

Remove one or more tags from an entity.

Remove single tag (legacy format):

Remove multiple tags (recommended):

A successful response will be empty ({}).

Post {VezaURL}/graph/private/tags:bulk

Add or remove tags from multiple entities in a single atomic operation. All operations execute within a single transaction; if any operation encounters a retryable error, the entire transaction rolls back.

Add tags to multiple nodes:

Remove tags from multiple nodes:

Combined add and remove operations:

A successful response will be empty ({}).

Tagging is a product capability allowing organizations to add additional metadata to the entities (such as users, roles, tables, or any other resource/identity) discovered by Veza.

curl 'https://{{VezaUrl}}/api/v1/graph/nodes/veza_tags' \
  --data-raw '{
      "node_id":"arn:aws:s3:::aws-cloudtrail-logs-527398259632-c98becd0",
      "tags":[
          {"key":"custom_tag","value":"one"}
        ]
    }'

You can filter search results for entities with a given tag, create access workflows based on tags, or use them to add context and notes that other users can view and search by.

To apply a tag, you will need the ID of the node to modify. Calling get query nodes will return IDs as part of the search result. You can also retrieve this value by clicking Show Details for the entity in Access Graph, or checking the ID column from Identity Data Entities or the Query Builder.

Quick Start

Generate a bearer token from Administration > API Keys.

For the examples below, BASEURL should be the address of your Veza instance, such as https://<org>.vezacloud.com.

Use Get Query Spec Nodes to find Snowflake tables reachable by federated Okta users belonging to the Finance department:

The response will include the table id:

Apply a tag by specifying a key and optional value:

Remove a tag by providing the entity id and the tag key to delete: