diff --git a/asm/openapi.yaml b/asm/openapi.yaml
index 3673084..205735a 100644
--- a/asm/openapi.yaml
+++ b/asm/openapi.yaml
@@ -347,6 +347,7 @@ paths:
     get:
       operationId: listTags
       summary: List tags
+      description: Returns all tags defined in the tenant.
       tags: [Tags]
       responses:
         '200':
@@ -365,6 +366,7 @@ paths:
     post:
       operationId: createTag
       summary: Create tag
+      description: Creates a new organizational tag that can be applied to assets.
       tags: [Tags]
       requestBody:
         required: true
@@ -393,6 +395,57 @@ paths:
         '401':
           $ref: '#/components/responses/Unauthorized'
 
+  /tags/{tag_id}:
+    parameters:
+      - $ref: '#/components/parameters/TagId'
+    patch:
+      operationId: updateTag
+      summary: Update tag
+      description: Update the name or color of an existing tag.
+      tags: [Tags]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              minProperties: 1
+              properties:
+                name:
+                  type: string
+                  maxLength: 64
+                color:
+                  type: string
+                  pattern: '^#[0-9a-fA-F]{6}$'
+                  example: '#e63946'
+      responses:
+        '200':
+          description: Updated tag
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+    delete:
+      operationId: deleteTag
+      summary: Delete tag
+      description: |
+        Permanently deletes a tag. The tag is automatically removed from all
+        assets it was applied to.
+      tags: [Tags]
+      responses:
+        '204':
+          description: Tag deleted
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+
 components:
   securitySchemes:
     bearerAuth:
@@ -426,6 +479,14 @@ components:
         type: string
         pattern: '^ast_[a-z0-9]{16}$'
       example: ast_1a2b3c4d5e6f0001
+    TagId:
+      name: tag_id
+      in: path
+      required: true
+      schema:
+        type: string
+        pattern: '^tag_[a-z0-9]{16}$'
+      example: tag_0001aabbccdd0001
 
   responses:
     Unauthorized: