Stay organized with collections
Save and categorize content based on your preferences.
This page
applies to Apigee and Apigee hybrid.
This page describes how to attach and manage tags for API hub resources. API hub currently only supports tags using the gcloud CLI.
What are tags?
Tags are metadata key-value pairs that are attached to Google Cloud resources. Tags are used for several purposes:
To conditionally allow or deny policies based on whether a resource has a specific tag.
To group and organise your resources.
To filter your resources.
Tagging resources involves creating tags, managing access, and attaching key-value pairs. Each key can have only one value per resource. For example, a resource tagged with environment: development cannot also be tagged with environment: production or environment: test. The maximum number of tags allowed per resource is 50.
Supported resources
You can attach tags to the following API hub resources after resource creation:
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
To initialize the gcloud CLI, run the following command:
gcloudinit
To manage tags for API hub resources, user accounts and service accounts should be granted the Tag User (roles/resourcemanager.tagUser) role. For more information, see Tags roles and permissions.
You can use tags and IAM conditions to conditionally grant role bindings to users. If an IAM policy with conditional role bindings is applied, changing or deleting the tag attached to a resource can remove user access to that resource.
To detach tags from a resource, you must delete the tag binding resource that links the tag value to the Google Cloud resource. See Detaching tags from a resource for detailed instructions.
To get a list of tag bindings directly attached to a resource, use the gcloud resource-manager tags bindings list command. You can add the --effective flag, to additonally return a list of tags inherited by this resource. See Listing tags for detailed instructions.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-09 UTC."],[],[],null,["*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\nThis page describes how to attach and manage tags for API hub resources. API hub currently only supports tags using the gcloud CLI.\n\nWhat are tags?\n\n[Tags](/resource-manager/docs/tags/tags-overview) are metadata key-value pairs that are attached to Google Cloud resources. Tags are used for several purposes:\n\n- To conditionally allow or deny policies based on whether a resource has a specific tag.\n- To group and organise your resources.\n- To filter your resources.\n\n\nTagging resources involves creating tags, managing access, and attaching key-value pairs. Each key can have only one value per resource. For example, a resource tagged with `environment: development` cannot also be tagged with `environment: production` or `environment: test`. The maximum number of tags allowed per resource is **50**.\n| **Note:** Tags are different from [labels](/resource-manager/docs/creating-managing-labels#what-are-labels), which are another way to organize and filter your resources. Tags and labels work independently of each other, and you can use both on the same resource.\n\nSupported resources\n\n\nYou can attach tags to the following API hub resources after resource creation:\n\n- [APIs](/apigee/docs/apihub/apis-intro)\n- [API deployments](/apigee/docs/apihub/deployments-intro)\n| **Note:** By default, tags are inherited by child resources. For example, tags attached to an API are inherited by all API versions, operations, and specifications.\n\nBefore you begin\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n1. To manage tags for API hub resources, user accounts and service accounts should be granted the **Tag User** (`roles/resourcemanager.tagUser`) role. For more information, see [Tags roles and permissions](/resource-manager/docs/tags/tags-overview#required-permissions).\n2. Create and define tags. For more information, see [Create and manage tags](/resource-manager/docs/tags/tags-creating-and-managing).\n\nAttach tags to a resource\n\n\nTo attach tags to a resource, you must create a [TagBinding resource](/sdk/gcloud/reference/resource-manager/tags/bindings) that links the tag value to the Google Cloud resource. See [Attaching tags to a resource](/resource-manager/docs/tags/tags-creating-and-managing#gcloud_8) for detailed instructions.\n\ngcloud\n\nThe following example shows how to attach a tag to an API: \n\n```\ngcloud resource-manager tags bindings create \\\n--tag-value=tagValues/TAG_VALUE \\\n--parent=//apihub.googleapis.com/v1/projects/HUB_PROJECT/locations/HUB_LOCATION/apis/API_ID \\\n--location=HUB_LOCATION\n \n```\n\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e: the numeric ID of the Tag value\n- \u003cvar translate=\"no\"\u003eHUB_PROJECT\u003c/var\u003e: the project ID of the API hub project.\n- \u003cvar translate=\"no\"\u003eHUB_LOCATION\u003c/var\u003e: the location of the API hub project.\n- \u003cvar translate=\"no\"\u003eAPI_ID\u003c/var\u003e: the ID of the API.\n\n\u003cbr /\u003e\n\n**Example:** \n\n```\ngcloud resource-manager tags bindings create \\\n--tag-value=tagValues/123456789012 \\\n--parent=//apihub.googleapis.com/v1/projects/my-project/locations/us-central1/apis/my-api \\\n--location=us-central1\n```\n\nIAM conditions and tags\n\n\nYou can use tags and [IAM conditions](/apigee/docs/apihub/add-iam-conditions) to conditionally grant role bindings to users. If an IAM policy with conditional role bindings is applied, changing or deleting the tag attached to a resource can remove user access to that resource.\n\nFor more information, see [Tags and conditional access](/iam/docs/tags-access-control).\n\nDetach tags from a resource\n\n\nTo detach tags from a resource, you must delete the tag binding resource that links the tag value to the Google Cloud resource. See [Detaching tags from a resource](/resource-manager/docs/tags/tags-creating-and-managing#detaching) for detailed instructions.\n\ngcloud\n\nThe following example shows how to detach a tag from an API deployment: \n\n```\ngcloud resource-manager tags bindings delete \\\n--tag-value=tagValues/TAG_VALUE \\\n--parent=//apihub.googleapis.com/v1/projects/HUB_PROJECT/locations/HUB_LOCATION/deployments?deployment_id=DEPLOYMENT_ID \\\n--location=HUB_LOCATION\n \n```\n\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eTAG_VALUE\u003c/var\u003e: the numeric ID of the Tag value\n- \u003cvar translate=\"no\"\u003eHUB_PROJECT\u003c/var\u003e: the project ID of the API hub project.\n- \u003cvar translate=\"no\"\u003eHUB_LOCATION\u003c/var\u003e: the location of the API hub project.\n- \u003cvar translate=\"no\"\u003eDEPLOYMENT_ID\u003c/var\u003e: the ID of the deployment.\n\n\u003cbr /\u003e\n\n**Example:** \n\n```\ngcloud resource-manager tags bindings delete \\\n--tag-value=tagValues/123456789012 \\\n--parent=//apihub.googleapis.com/v1/projects/my-project/locations/us-central1/deployments?deployment_id=my-deployment \\\n--location=us-central1\n```\n\nList tags for a resource\n\n\nTo get a list of tag bindings directly attached to a resource, use the `gcloud resource-manager tags bindings list` command. You can add the `--effective` flag, to additonally return a list of tags inherited by this resource. See [Listing tags](/resource-manager/docs/tags/tags-creating-and-managing#listing_tags) for detailed instructions.\n\ngcloud\n\nThe following example shows how to list tags for an API: \n\n```\ngcloud resource-manager tags bindings list \\\n--parent=//apihub.googleapis.com/v1/projects/HUB_PROJECT/locations/HUB_LOCATION/apis/API_ID \\\n--location=HUB_LOCATION\n \n```\n\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eHUB_PROJECT\u003c/var\u003e: the project ID of the API hub project.\n- \u003cvar translate=\"no\"\u003eHUB_LOCATION\u003c/var\u003e: the location of the API hub project.\n- \u003cvar translate=\"no\"\u003eAPI_ID\u003c/var\u003e: the ID of the API.\n\n\u003cbr /\u003e\n\n**Example:** \n\n```\ngcloud resource-manager tags bindings list \\\n--parent=//apihub.googleapis.com/v1/projects/my-project/locations/us-central1/apis/my-api \\\n--location=us-central1 \n```\n\nWhat's next\n\n- Learn how to use tags with policies that support them to conditionally enforce those policies. See [Policies and tags](/resource-manager/docs/tags/tags-creating-and-managing#policies).\n- Learn how to add [IAM conditions](/apigee/docs/apihub/add-iam-conditions) in API hub."]]
