AWS Resource Groups Tagging API
Browse all Amazonaws APIsAgent-ready OpenAPI document · curated by JenticCloud InfrastructureComputehmac8 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Apply, remove, and audit tags across 100+ AWS resource types from one API and generate organisation-wide tag-compliance reports.
Use for: I need to apply CostCenter and Owner tags to a list of AWS resources, Find all S3 buckets in this account tagged Environment=prod, List every distinct tag key used across resources in this AWS account, Remove the legacy ProjectCode tag from every resource that has it
Not supported: Does not provision or delete the underlying AWS resources, does not work cross-region in a single call, and does not cover every AWS service - use for cross-service tag application, removal, and compliance reporting only.
Jentic publishes the only available OpenAPI specification for AWS Resource Groups Tagging API, keeping it validated and agent-ready. The Tagging API provides a unified interface for applying, removing, and querying tags across more than 100 supported AWS resource types - EC2, RDS, S3, Lambda, ECS, and more - without calling each service's individual tag operation. It also exposes tag-compliance reporting, so finance and platform teams can audit which resources are missing required cost-allocation tags. This is the operational backbone of cross-service tagging in AWS.
Install Jentic One Beta
Connect the AWS Resource Groups Tagging API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Resource Groups Tagging API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Faws-resource-groups-tagging-api" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Faws-resource-groups-tagging-api" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS Resource Groups Tagging API.
Apply tags to many AWS resources at once with TagResources, regardless of underlying service
Remove tags in bulk from arbitrary AWS ARNs with UntagResources
Search resources by tag key and value across services using GetResources with filtering and pagination
Enumerate the distinct tag keys and values used in an account via GetTagKeys and GetTagValues
Generate organisation-wide tag-compliance reports with StartReportCreation
Retrieve account-level tag-compliance summaries to find untagged or non-compliant resources
Use Cases
Patterns agents use AWS Resource Groups Tagging API for, with concrete tasks.
★ Cross-service cost-allocation tagging
Finance teams use the Tagging API to roll out cost-allocation tags such as CostCenter, Project, and Owner across hundreds of resources spanning EC2, RDS, S3, and Lambda from a single integration. TagResources accepts a batch of ARNs and a tag map, so a one-time backfill takes minutes instead of writing per-service automation. The same API then drives ongoing audits via GetResources and GetComplianceSummary.
Call TagResources with a batch of 50 ARNs spanning EC2 and RDS, applying CostCenter=marketing-2026 and Owner=platform-team to each.
Tag-compliance auditing
Governance and FinOps teams use StartReportCreation and GetComplianceSummary to identify resources missing required tags or violating an AWS Config tag policy. The report is written to S3 and lists each non-compliant ARN along with which required keys are missing. Agents can then call TagResources to remediate without leaving the same API.
Trigger StartReportCreation against the configured S3 bucket, poll DescribeReportCreation until SUCCEEDED, then parse the report to find resources missing the CostCenter tag.
Tag-driven resource discovery
Platform teams use GetResources with TagFilters to find every resource matching a tag query across services in one call - for example, all production-tier resources owned by a specific team. This replaces ad-hoc per-service calls (DescribeInstances, ListBuckets, ListFunctions) with a single paginated request, which keeps inventory tools simple and consistent.
Call GetResources with TagFilters [{Key: 'Environment', Values: ['prod']}, {Key: 'Team', Values: ['payments']}] and paginate through all results.
Agent-driven tag remediation through Jentic
AI agents that detect drift in cost-allocation tags use Jentic to call TagResources and UntagResources without holding raw AWS access keys. Jentic stores the agent's AWS credentials in your Jentic One instance, signs each request with SigV4, and returns the structured response - letting the agent confirm each tag change before moving to the next batch.
Search Jentic for 'apply tags to AWS resources', load the TagResources schema, and execute it against 25 ARNs identified as non-compliant in a prior compliance summary.
Key Endpoints
8 endpoints — jentic publishes the only available openapi specification for aws resource groups tagging api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.TagResources
Apply tags to a batch of resource ARNs
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.UntagResources
Remove tags from a batch of resource ARNs
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetResources
List resources matching tag filters
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagKeys
List all tag keys used in the account
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagValues
List all values for a given tag key
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetComplianceSummary
Retrieve tag-policy compliance metrics
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation
Generate a compliance report to S3
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.DescribeReportCreation
Poll the status of an in-flight compliance report
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.TagResources
Apply tags to a batch of resource ARNs
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.UntagResources
Remove tags from a batch of resource ARNs
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetResources
List resources matching tag filters
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagKeys
List all tag keys used in the account
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetTagValues
List all values for a given tag key
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.GetComplianceSummary
Retrieve tag-policy compliance metrics
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation
Generate a compliance report to S3
POST
/#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.DescribeReportCreation
Poll the status of an in-flight compliance report
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Resource Groups Tagging API by hand means computing SigV4 HMAC signatures, setting the X-Amz-Target header per action, routing to the regional tagging host, batching resource ARNs, and backing off on throttling yourself. Through Jentic you install once, import AWS Resource Groups Tagging API from the API Directory, store your AWS access keys once, and your agent calls it with signing and targeting handled per request.
Permission scoping
Resource ARNs and tag keys travel in the request body rather than the URL path, so you limit the agent to the operations it needs, such as GetResources and GetComplianceSummary for read and reporting. Mutating operations like TagResources and UntagResources are not included unless you add them.
Credential isolation
Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to produce a SigV4 signature per request. The raw secret access key never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'report on tags across AWS resources', and Jentic returns GetResources with its input schema for TagFilters and ResourceTypeFilters so the agent calls the right endpoint directly.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS Resource Groups Tagging API through Jentic.
Why is there no official OpenAPI spec for AWS Resource Groups Tagging API?
AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Groups Tagging API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the AWS Resource Groups Tagging API use?
It uses AWS Signature Version 4 HMAC signing with an access key ID, secret access key, and optional session token. Through Jentic, your AWS credentials sit in your Jentic One instance and Jentic signs each request server-side, so the agent never sees raw secrets.
Can I tag resources across multiple AWS regions in one call to the AWS Resource Groups Tagging API?
No - the Tagging API is regional. TagResources only operates on ARNs in the region you call. To tag a multi-region fleet, iterate per region: list ARNs in each region with GetResources, then call TagResources against the regional endpoint.
What are the rate limits for the AWS Resource Groups Tagging API?
AWS does not publish a fixed RPS in the spec; standard AWS API throttling applies and the service returns ThrottlingException on overage. TagResources also has a per-call cap (typically 20 ARNs per request), so high-volume agents should batch and back off with jitter.
How do I generate a tag-compliance report with the AWS Resource Groups Tagging API through Jentic?
Search Jentic for 'generate AWS tag compliance report', load StartReportCreation, and call POST /#X-Amz-Target=ResourceGroupsTaggingAPI_20170126.StartReportCreation with the destination S3 bucket. Then poll DescribeReportCreation until status is SUCCEEDED and read the report from S3. Install with pip install jentic.
Can the AWS Resource Groups Tagging API tag every AWS service?
It supports 100+ resource types but not every service is covered - for example, some IAM resources and a small set of legacy services still require their own tag operations. Check the AWS docs for the supported resource list before assuming a service is tag-API addressable, and fall back to the per-service tag operation when not.
Can I limit what my agent is allowed to do with the AWS Resource Groups Tagging API?
Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use, so you can grant only the endpoints it needs, such as GetResources and GetComplianceSummary for read and reporting. Mutating operations like TagResources and UntagResources are not available to the agent unless you add them. Resource ARNs and tag keys travel in the request body rather than the URL path, so scoping is done per operation rather than by parsing paths.
GET STARTED