Tunnel Tags
Durable, account-owned labels attached to a tunnel. These are the editable counterpart to the ephemeral agent-reported tags returned inside the agents[] array on GET /v1/tunnels/{id} — agent-reported tags are rewritten on every reconnect, whereas these survive disconnect/reconnect because they're keyed by the stable tunnel ID.
Tags are normalized server-side: trimmed, lowercased (so Prod and prod collapse to one), and truncated to 64 characters. A single tunnel may carry at most 20 tags.
Account scope: tags belong to your active account — a tunnel must belong to that account before its tags can be read or written. Use switch account to act in a different account.
List Account Tags
Returns the active account's full distinct set of durable tags — used to seed a fleet-filter dropdown without paging through every tunnel.
Response (200 OK)
Add a Tag
Adds a durable tag to a tunnel the account owns. Idempotent — re-adding an existing tag is a no-op and does not count against the per-tunnel cap. Returns the tunnel's full tag set after the add.
Path parameters
Request body
Response (200 OK)
Remove a Tag
Deletes a durable tag from a tunnel the account owns. Idempotent — deleting a tag that isn't present is still a 200 with the resulting set. Returns the tunnel's full tag set after the delete.