@iblai/iblai-api 4.266.0-core → 4.267.0-core

package/sdk_schema.yml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ibl-data-manager
-  version: 4.266.0-core
+  version: 4.267.0-core
   description: API for iblai
 paths:
   /access-check/{item_type}/{item_id}/:
@@ -231,7 +231,7 @@ paths:
       description: |-
         Creates an Activity. Either `deal` or `person` must be supplied; both must belong to your Platform.
 
-        **Required permission:** `Ibl.CRM/Activities/write`.
+        **Required permission:** `Ibl.CRM/Activities/action`.
       summary: Create an activity
       tags:
       - activities
@@ -265,7 +265,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Activities/write`.
+          description: Missing required permission `Ibl.CRM/Activities/action`.
   /activities/{id}/:
     get:
       operationId: activities_retrieve
@@ -25291,7 +25291,7 @@ paths:
       description: |-
         Creates an Activity. Either `deal` or `person` must be supplied; both must belong to your Platform.
 
-        **Required permission:** `Ibl.CRM/Activities/write`.
+        **Required permission:** `Ibl.CRM/Activities/action`.
       summary: Create an activity
       tags:
       - crm
@@ -25325,7 +25325,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Activities/write`.
+          description: Missing required permission `Ibl.CRM/Activities/action`.
   /api/crm/activities/{id}/:
     get:
       operationId: crm_activities_retrieve
@@ -25593,6 +25593,10 @@ paths:
           * `open` - Open
           * `won` - Won
           * `lost` - Lost
+      - in: query
+        name: tags
+        schema:
+          type: string
       tags:
       - crm
       security:
@@ -25613,7 +25617,7 @@ paths:
       description: |-
         Creates a new Deal. All FK targets (`person`, `organization`, `pipeline`, `stage`, `source`) must belong to your Platform; `stage` must belong to `pipeline`. `status` and `closed_at` are service-managed — passing them returns `400`.
 
-        **Required permission:** `Ibl.CRM/Deals/write`.
+        **Required permission:** `Ibl.CRM/Deals/action`.
       summary: Create a deal
       tags:
       - crm
@@ -25647,7 +25651,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Deals/write`.
+          description: Missing required permission `Ibl.CRM/Deals/action`.
   /api/crm/deals/{id}/:
     get:
       operationId: crm_deals_retrieve
@@ -25900,14 +25904,14 @@ paths:
           description: Missing required permission `Ibl.CRM/Deals/write`.
         '404':
           description: Deal or stage not found.
-  /api/crm/deals/{id}/won/:
+  /api/crm/deals/{id}/tags/:
     post:
-      operationId: crm_deals_won_create
+      operationId: crm_deals_tags_create
       description: |-
-        Moves the Deal into a closed-won stage and sets `status='won'`. If `stage_code` is omitted, the first `is_won=True` stage in the Deal's pipeline (by sort order) is used.
+        Attaches an existing Tag to this record. Both the Tag and the record must belong to your Platform. Returns `409 Conflict` with the existing `assignment_id` if the tag is already attached.
 
-        **Required permission:** `Ibl.CRM/Deals/write`.
-      summary: Mark a deal as won
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Attach a tag to this record
       parameters:
       - in: path
         name: id
@@ -25921,211 +25925,79 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/DealWonRequest'
+              $ref: '#/components/schemas/_TagAttachRequest'
           application/scim+json:
             schema:
-              $ref: '#/components/schemas/DealWonRequest'
+              $ref: '#/components/schemas/_TagAttachRequest'
           application/x-www-form-urlencoded:
             schema:
-              $ref: '#/components/schemas/DealWonRequest'
+              $ref: '#/components/schemas/_TagAttachRequest'
           multipart/form-data:
             schema:
-              $ref: '#/components/schemas/DealWonRequest'
+              $ref: '#/components/schemas/_TagAttachRequest'
           '*/*':
             schema:
-              $ref: '#/components/schemas/DealWonRequest'
-      security:
-      - PlatformApiKeyAuthentication: []
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Deal'
-          description: ''
-        '400':
-          description: No `is_won` stage configured, or the supplied stage_code is
-            not flagged is_won=True.
-        '403':
-          description: Missing required permission `Ibl.CRM/Deals/write`.
-        '404':
-          description: Deal not found.
-  /api/crm/lead-sources/:
-    get:
-      operationId: crm_lead_sources_list
-      description: |-
-        Returns a paginated list of LeadSources in your Platform.
-
-        **Required permission:** `Ibl.CRM/Pipelines/list`.
-      summary: List lead sources
-      parameters:
-      - in: query
-        name: code
-        schema:
-          type: string
-      - in: query
-        name: name
-        schema:
-          type: string
-      - name: page
-        required: false
-        in: query
-        description: A page number within the paginated result set.
-        schema:
-          type: integer
-      - name: page_size
-        required: false
-        in: query
-        description: Number of results to return per page.
-        schema:
-          type: integer
-      tags:
-      - crm
-      security:
-      - PlatformApiKeyAuthentication: []
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/PaginatedLeadSourceList'
-          description: ''
-        '401':
-          description: Authentication required.
-        '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/list`.
-    post:
-      operationId: crm_lead_sources_create
-      description: |-
-        Creates a new LeadSource in your Platform. `code` must be unique.
-
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
-      summary: Create a lead source
-      tags:
-      - crm
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          application/x-www-form-urlencoded:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          multipart/form-data:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          '*/*':
-            schema:
-              $ref: '#/components/schemas/LeadSource'
+              $ref: '#/components/schemas/_TagAttachRequest'
         required: true
       security:
       - PlatformApiKeyAuthentication: []
       responses:
         '201':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LeadSource'
-          description: ''
+          description: No response body
         '400':
-          description: Validation error.
+          description: No response body
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
-  /api/crm/lead-sources/{id}/:
-    get:
-      operationId: crm_lead_sources_retrieve
+          description: No response body
+        '404':
+          description: No response body
+        '409':
+          description: No response body
+  /api/crm/deals/{id}/tags/{tag_id}/:
+    delete:
+      operationId: crm_deals_tags_destroy
       description: |-
-        Returns a single LeadSource by id.
+        Removes the Tag with id `tag_id` from this record. Returns `404` if the tag was not attached.
 
-        **Required permission:** `Ibl.CRM/Pipelines/read`.
-      summary: Retrieve a lead source
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Detach a tag from this record
       parameters:
       - in: path
         name: id
         schema:
           type: integer
-        description: A unique integer value identifying this lead source.
+        description: A unique integer value identifying this deal.
         required: true
-      tags:
-      - crm
-      security:
-      - PlatformApiKeyAuthentication: []
-      responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LeadSource'
-          description: ''
-        '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/read`.
-        '404':
-          description: LeadSource not found.
-    put:
-      operationId: crm_lead_sources_update
-      description: |-
-        Replaces all editable fields on the LeadSource.
-
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
-      summary: Replace a lead source
-      parameters:
       - in: path
-        name: id
+        name: tag_id
         schema:
-          type: integer
-        description: A unique integer value identifying this lead source.
+          type: string
+          pattern: ^\d+$
         required: true
       tags:
       - crm
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          application/x-www-form-urlencoded:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          multipart/form-data:
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-          '*/*':
-            schema:
-              $ref: '#/components/schemas/LeadSource'
-        required: true
       security:
       - PlatformApiKeyAuthentication: []
       responses:
-        '200':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LeadSource'
-          description: ''
-        '400':
-          description: Validation error.
+        '204':
+          description: No response body
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+          description: No response body
         '404':
-          description: LeadSource not found.
-    patch:
-      operationId: crm_lead_sources_partial_update
+          description: No response body
+  /api/crm/deals/{id}/won/:
+    post:
+      operationId: crm_deals_won_create
       description: |-
-        Updates only the supplied fields on the LeadSource.
+        Moves the Deal into a closed-won stage and sets `status='won'`. If `stage_code` is omitted, the first `is_won=True` stage in the Deal's pipeline (by sort order) is used.
 
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
-      summary: Update a lead source
+        **Required permission:** `Ibl.CRM/Deals/write`.
+      summary: Mark a deal as won
       parameters:
       - in: path
         name: id
         schema:
           type: integer
-        description: A unique integer value identifying this lead source.
+        description: A unique integer value identifying this deal.
         required: true
       tags:
       - crm
@@ -26133,19 +26005,19 @@ paths:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/PatchedLeadSource'
+              $ref: '#/components/schemas/DealWonRequest'
           application/scim+json:
             schema:
-              $ref: '#/components/schemas/PatchedLeadSource'
+              $ref: '#/components/schemas/DealWonRequest'
           application/x-www-form-urlencoded:
             schema:
-              $ref: '#/components/schemas/PatchedLeadSource'
+              $ref: '#/components/schemas/DealWonRequest'
           multipart/form-data:
             schema:
-              $ref: '#/components/schemas/PatchedLeadSource'
+              $ref: '#/components/schemas/DealWonRequest'
           '*/*':
             schema:
-              $ref: '#/components/schemas/PatchedLeadSource'
+              $ref: '#/components/schemas/DealWonRequest'
       security:
       - PlatformApiKeyAuthentication: []
       responses:
@@ -26153,56 +26025,32 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/LeadSource'
+                $ref: '#/components/schemas/Deal'
           description: ''
         '400':
-          description: Validation error.
-        '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
-        '404':
-          description: LeadSource not found.
-    delete:
-      operationId: crm_lead_sources_destroy
-      description: |-
-        Deletes the LeadSource. Any Deals referencing it have their `source` cleared.
-
-        **Required permission:** `Ibl.CRM/Pipelines/delete`.
-      summary: Delete a lead source
-      parameters:
-      - in: path
-        name: id
-        schema:
-          type: integer
-        description: A unique integer value identifying this lead source.
-        required: true
-      tags:
-      - crm
-      security:
-      - PlatformApiKeyAuthentication: []
-      responses:
-        '204':
-          description: Deleted.
+          description: No `is_won` stage configured, or the supplied stage_code is
+            not flagged is_won=True.
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/delete`.
+          description: Missing required permission `Ibl.CRM/Deals/write`.
         '404':
-          description: LeadSource not found.
-  /api/crm/organizations/:
+          description: Deal not found.
+  /api/crm/lead-sources/:
     get:
-      operationId: crm_organizations_list
+      operationId: crm_lead_sources_list
       description: |-
-        Returns a paginated list of organizations in your Platform. Supports filtering by `owner` and by `name` (case-insensitive substring match).
+        Returns a paginated list of LeadSources in your Platform.
 
-        **Required permission:** `Ibl.CRM/Organizations/list`.
-      summary: List organizations
+        **Required permission:** `Ibl.CRM/Pipelines/list`.
+      summary: List lead sources
       parameters:
       - in: query
-        name: name
+        name: code
         schema:
           type: string
       - in: query
-        name: owner
+        name: name
         schema:
-          type: number
+          type: string
       - name: page
         required: false
         in: query
@@ -26219,6 +26067,246 @@ paths:
       - crm
       security:
       - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedLeadSourceList'
+          description: ''
+        '401':
+          description: Authentication required.
+        '403':
+          description: Missing required permission `Ibl.CRM/Pipelines/list`.
+    post:
+      operationId: crm_lead_sources_create
+      description: |-
+        Creates a new LeadSource in your Platform. `code` must be unique.
+
+        **Required permission:** `Ibl.CRM/Pipelines/action`.
+      summary: Create a lead source
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LeadSource'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Pipelines/action`.
+  /api/crm/lead-sources/{id}/:
+    get:
+      operationId: crm_lead_sources_retrieve
+      description: |-
+        Returns a single LeadSource by id.
+
+        **Required permission:** `Ibl.CRM/Pipelines/read`.
+      summary: Retrieve a lead source
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this lead source.
+        required: true
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LeadSource'
+          description: ''
+        '403':
+          description: Missing required permission `Ibl.CRM/Pipelines/read`.
+        '404':
+          description: LeadSource not found.
+    put:
+      operationId: crm_lead_sources_update
+      description: |-
+        Replaces all editable fields on the LeadSource.
+
+        **Required permission:** `Ibl.CRM/Pipelines/write`.
+      summary: Replace a lead source
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this lead source.
+        required: true
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/LeadSource'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LeadSource'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+        '404':
+          description: LeadSource not found.
+    patch:
+      operationId: crm_lead_sources_partial_update
+      description: |-
+        Updates only the supplied fields on the LeadSource.
+
+        **Required permission:** `Ibl.CRM/Pipelines/write`.
+      summary: Update a lead source
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this lead source.
+        required: true
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchedLeadSource'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/PatchedLeadSource'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/PatchedLeadSource'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/PatchedLeadSource'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/PatchedLeadSource'
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LeadSource'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+        '404':
+          description: LeadSource not found.
+    delete:
+      operationId: crm_lead_sources_destroy
+      description: |-
+        Deletes the LeadSource. Any Deals referencing it have their `source` cleared.
+
+        **Required permission:** `Ibl.CRM/Pipelines/delete`.
+      summary: Delete a lead source
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this lead source.
+        required: true
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: Deleted.
+        '403':
+          description: Missing required permission `Ibl.CRM/Pipelines/delete`.
+        '404':
+          description: LeadSource not found.
+  /api/crm/organizations/:
+    get:
+      operationId: crm_organizations_list
+      description: |-
+        Returns a paginated list of organizations in your Platform. Supports filtering by `owner` and by `name` (case-insensitive substring match).
+
+        **Required permission:** `Ibl.CRM/Organizations/list`.
+      summary: List organizations
+      parameters:
+      - in: query
+        name: name
+        schema:
+          type: string
+      - in: query
+        name: owner
+        schema:
+          type: number
+      - name: page
+        required: false
+        in: query
+        description: A page number within the paginated result set.
+        schema:
+          type: integer
+      - name: page_size
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      - in: query
+        name: tags
+        schema:
+          type: string
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
       responses:
         '200':
           content:
@@ -26235,7 +26323,7 @@ paths:
       description: |-
         Creates a new organization in your Platform. The Platform is inferred from your credentials. `name` must be unique within your Platform.
 
-        **Required permission:** `Ibl.CRM/Organizations/write`.
+        **Required permission:** `Ibl.CRM/Organizations/action`.
       summary: Create an organization
       tags:
       - crm
@@ -26269,7 +26357,7 @@ paths:
         '400':
           description: Validation error (for example, duplicate name).
         '403':
-          description: Missing required permission `Ibl.CRM/Organizations/write`.
+          description: Missing required permission `Ibl.CRM/Organizations/action`.
   /api/crm/organizations/{id}/:
     get:
       operationId: crm_organizations_retrieve
@@ -26426,6 +26514,88 @@ paths:
           description: Missing required permission `Ibl.CRM/Organizations/delete`.
         '404':
           description: Organization not found.
+  /api/crm/organizations/{id}/tags/:
+    post:
+      operationId: crm_organizations_tags_create
+      description: |-
+        Attaches an existing Tag to this record. Both the Tag and the record must belong to your Platform. Returns `409 Conflict` with the existing `assignment_id` if the tag is already attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Attach a tag to this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          description: No response body
+        '400':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
+        '409':
+          description: No response body
+  /api/crm/organizations/{id}/tags/{tag_id}/:
+    delete:
+      operationId: crm_organizations_tags_destroy
+      description: |-
+        Removes the Tag with id `tag_id` from this record. Returns `404` if the tag was not attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Detach a tag from this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      - in: path
+        name: tag_id
+        schema:
+          type: string
+          pattern: ^\d+$
+        required: true
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
   /api/crm/persons/:
     get:
       operationId: crm_persons_list
@@ -26488,6 +26658,10 @@ paths:
         description: Number of results to return per page.
         schema:
           type: integer
+      - in: query
+        name: tags
+        schema:
+          type: string
       tags:
       - crm
       security:
@@ -26508,7 +26682,7 @@ paths:
       description: |-
         Creates a new person in your Platform. The Platform is inferred from your credentials. If `organization` is supplied, it must reference an organization in your Platform.
 
-        **Required permission:** `Ibl.CRM/Persons/write`.
+        **Required permission:** `Ibl.CRM/Persons/action`.
       summary: Create a person
       tags:
       - crm
@@ -26542,7 +26716,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Persons/write`.
+          description: Missing required permission `Ibl.CRM/Persons/action`.
   /api/crm/persons/{id}/:
     get:
       operationId: crm_persons_retrieve
@@ -26813,6 +26987,88 @@ paths:
             target user is not a member of your Platform.
         '404':
           description: Person or user not found.
+  /api/crm/persons/{id}/tags/:
+    post:
+      operationId: crm_persons_tags_create
+      description: |-
+        Attaches an existing Tag to this record. Both the Tag and the record must belong to your Platform. Returns `409 Conflict` with the existing `assignment_id` if the tag is already attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Attach a tag to this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          description: No response body
+        '400':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
+        '409':
+          description: No response body
+  /api/crm/persons/{id}/tags/{tag_id}/:
+    delete:
+      operationId: crm_persons_tags_destroy
+      description: |-
+        Removes the Tag with id `tag_id` from this record. Returns `404` if the tag was not attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Detach a tag from this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      - in: path
+        name: tag_id
+        schema:
+          type: string
+          pattern: ^\d+$
+        required: true
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
   /api/crm/persons/merge/:
     post:
       operationId: crm_persons_merge_create
@@ -26912,7 +27168,7 @@ paths:
       description: |-
         Creates a new Pipeline. `code` must be unique within your Platform. Promoting another Pipeline to `is_default=true` while one already exists will fail — unset the existing default first.
 
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
+        **Required permission:** `Ibl.CRM/Pipelines/action`.
       summary: Create a pipeline
       tags:
       - crm
@@ -26946,7 +27202,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+          description: Missing required permission `Ibl.CRM/Pipelines/action`.
   /api/crm/pipelines/{pipeline_pk}/stages/:
     get:
       operationId: crm_pipelines_stages_list
@@ -27005,7 +27261,7 @@ paths:
       description: |-
         Creates a new PipelineStage in the URL Pipeline. `code` must be unique within that Pipeline. At most one of `is_won` / `is_lost` may be true.
 
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
+        **Required permission:** `Ibl.CRM/Pipelines/action`.
       summary: Create a stage
       parameters:
       - in: path
@@ -27045,7 +27301,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+          description: Missing required permission `Ibl.CRM/Pipelines/action`.
         '404':
           description: Pipeline not found.
   /api/crm/pipelines/{pipeline_pk}/stages/{id}/:
@@ -27372,6 +27628,248 @@ paths:
           description: Pipeline not found.
         '409':
           description: Pipeline still has Deals attached.
+  /api/crm/tags/:
+    get:
+      operationId: crm_tags_list
+      description: |-
+        Returns a paginated list of Tags in your Platform. Supports filtering by `name` (case-insensitive substring) and `created_at__gte`/`created_at__lte` ISO timestamp ranges.
+
+        **Required permission:** `Ibl.CRM/Tags/list`.
+      summary: List tags
+      parameters:
+      - in: query
+        name: created_at__gte
+        schema:
+          type: string
+          format: date-time
+      - in: query
+        name: created_at__lte
+        schema:
+          type: string
+          format: date-time
+      - in: query
+        name: name
+        schema:
+          type: string
+      - name: page
+        required: false
+        in: query
+        description: A page number within the paginated result set.
+        schema:
+          type: integer
+      - name: page_size
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedTagList'
+          description: ''
+        '401':
+          description: Authentication required.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/list`.
+    post:
+      operationId: crm_tags_create
+      description: |-
+        Creates a new Tag in your Platform. `name` must be unique within your Platform; supply `color` as a `#RRGGBB` hex string (defaults to `#888888`).
+
+        **Required permission:** `Ibl.CRM/Tags/action`.
+      summary: Create a tag
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/Tag'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '400':
+          description: Validation error (duplicate name, bad color, etc.).
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/action`.
+  /api/crm/tags/{id}/:
+    get:
+      operationId: crm_tags_retrieve
+      description: |-
+        Returns a single Tag by id.
+
+        **Required permission:** `Ibl.CRM/Tags/read`.
+      summary: Retrieve a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/read`.
+        '404':
+          description: Tag not found.
+    put:
+      operationId: crm_tags_update
+      description: |-
+        Replaces all editable fields on the Tag.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Replace a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/Tag'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/write`.
+        '404':
+          description: Tag not found.
+    patch:
+      operationId: crm_tags_partial_update
+      description: |-
+        Updates only the supplied fields on the Tag (typically `name` or `color`).
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Update a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - crm
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/write`.
+        '404':
+          description: Tag not found.
+    delete:
+      operationId: crm_tags_destroy
+      description: |-
+        Deletes the Tag. All attachments to Persons, Organizations, and Deals are removed atomically via cascade.
+
+        **Required permission:** `Ibl.CRM/Tags/delete`.
+      summary: Delete a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - crm
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: Deleted.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/delete`.
+        '404':
+          description: Tag not found.
   /api/custom-domains/:
     get:
       operationId: custom_domains_retrieve
@@ -38997,6 +39495,10 @@ paths:
           * `open` - Open
           * `won` - Won
           * `lost` - Lost
+      - in: query
+        name: tags
+        schema:
+          type: string
       tags:
       - deals
       security:
@@ -39017,7 +39519,7 @@ paths:
       description: |-
         Creates a new Deal. All FK targets (`person`, `organization`, `pipeline`, `stage`, `source`) must belong to your Platform; `stage` must belong to `pipeline`. `status` and `closed_at` are service-managed — passing them returns `400`.
 
-        **Required permission:** `Ibl.CRM/Deals/write`.
+        **Required permission:** `Ibl.CRM/Deals/action`.
       summary: Create a deal
       tags:
       - deals
@@ -39051,7 +39553,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Deals/write`.
+          description: Missing required permission `Ibl.CRM/Deals/action`.
   /deals/{id}/:
     get:
       operationId: deals_retrieve
@@ -39304,6 +39806,86 @@ paths:
           description: Missing required permission `Ibl.CRM/Deals/write`.
         '404':
           description: Deal or stage not found.
+  /deals/{id}/tags/:
+    post:
+      operationId: deals_tags_create
+      description: |-
+        Attaches an existing Tag to this record. Both the Tag and the record must belong to your Platform. Returns `409 Conflict` with the existing `assignment_id` if the tag is already attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Attach a tag to this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this deal.
+        required: true
+      tags:
+      - deals
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          description: No response body
+        '400':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
+        '409':
+          description: No response body
+  /deals/{id}/tags/{tag_id}/:
+    delete:
+      operationId: deals_tags_destroy
+      description: |-
+        Removes the Tag with id `tag_id` from this record. Returns `404` if the tag was not attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Detach a tag from this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this deal.
+        required: true
+      - in: path
+        name: tag_id
+        schema:
+          type: string
+          pattern: ^\d+$
+        required: true
+      tags:
+      - deals
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
   /deals/{id}/won/:
     post:
       operationId: deals_won_create
@@ -39427,7 +40009,7 @@ paths:
       description: |-
         Creates a new LeadSource in your Platform. `code` must be unique.
 
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
+        **Required permission:** `Ibl.CRM/Pipelines/action`.
       summary: Create a lead source
       tags:
       - lead-sources
@@ -39461,7 +40043,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+          description: Missing required permission `Ibl.CRM/Pipelines/action`.
   /lead-sources/{id}/:
     get:
       operationId: lead_sources_retrieve
@@ -39643,6 +40225,10 @@ paths:
         description: Number of results to return per page.
         schema:
           type: integer
+      - in: query
+        name: tags
+        schema:
+          type: string
       tags:
       - organizations
       security:
@@ -39663,7 +40249,7 @@ paths:
       description: |-
         Creates a new organization in your Platform. The Platform is inferred from your credentials. `name` must be unique within your Platform.
 
-        **Required permission:** `Ibl.CRM/Organizations/write`.
+        **Required permission:** `Ibl.CRM/Organizations/action`.
       summary: Create an organization
       tags:
       - organizations
@@ -39697,7 +40283,7 @@ paths:
         '400':
           description: Validation error (for example, duplicate name).
         '403':
-          description: Missing required permission `Ibl.CRM/Organizations/write`.
+          description: Missing required permission `Ibl.CRM/Organizations/action`.
   /organizations/{id}/:
     get:
       operationId: organizations_retrieve
@@ -39854,6 +40440,88 @@ paths:
           description: Missing required permission `Ibl.CRM/Organizations/delete`.
         '404':
           description: Organization not found.
+  /organizations/{id}/tags/:
+    post:
+      operationId: organizations_tags_create
+      description: |-
+        Attaches an existing Tag to this record. Both the Tag and the record must belong to your Platform. Returns `409 Conflict` with the existing `assignment_id` if the tag is already attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Attach a tag to this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      tags:
+      - organizations
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          description: No response body
+        '400':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
+        '409':
+          description: No response body
+  /organizations/{id}/tags/{tag_id}/:
+    delete:
+      operationId: organizations_tags_destroy
+      description: |-
+        Removes the Tag with id `tag_id` from this record. Returns `404` if the tag was not attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Detach a tag from this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      - in: path
+        name: tag_id
+        schema:
+          type: string
+          pattern: ^\d+$
+        required: true
+      tags:
+      - organizations
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
   /persons/:
     get:
       operationId: persons_list
@@ -39916,6 +40584,10 @@ paths:
         description: Number of results to return per page.
         schema:
           type: integer
+      - in: query
+        name: tags
+        schema:
+          type: string
       tags:
       - persons
       security:
@@ -39936,7 +40608,7 @@ paths:
       description: |-
         Creates a new person in your Platform. The Platform is inferred from your credentials. If `organization` is supplied, it must reference an organization in your Platform.
 
-        **Required permission:** `Ibl.CRM/Persons/write`.
+        **Required permission:** `Ibl.CRM/Persons/action`.
       summary: Create a person
       tags:
       - persons
@@ -39970,7 +40642,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Persons/write`.
+          description: Missing required permission `Ibl.CRM/Persons/action`.
   /persons/{id}/:
     get:
       operationId: persons_retrieve
@@ -40241,6 +40913,88 @@ paths:
             target user is not a member of your Platform.
         '404':
           description: Person or user not found.
+  /persons/{id}/tags/:
+    post:
+      operationId: persons_tags_create
+      description: |-
+        Attaches an existing Tag to this record. Both the Tag and the record must belong to your Platform. Returns `409 Conflict` with the existing `assignment_id` if the tag is already attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Attach a tag to this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      tags:
+      - persons
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/_TagAttachRequest'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          description: No response body
+        '400':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
+        '409':
+          description: No response body
+  /persons/{id}/tags/{tag_id}/:
+    delete:
+      operationId: persons_tags_destroy
+      description: |-
+        Removes the Tag with id `tag_id` from this record. Returns `404` if the tag was not attached.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Detach a tag from this record
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+          description: Opaque UUID — used in API URLs and external references.
+        required: true
+      - in: path
+        name: tag_id
+        schema:
+          type: string
+          pattern: ^\d+$
+        required: true
+      tags:
+      - persons
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: No response body
+        '403':
+          description: No response body
+        '404':
+          description: No response body
   /persons/merge/:
     post:
       operationId: persons_merge_create
@@ -40340,7 +41094,7 @@ paths:
       description: |-
         Creates a new Pipeline. `code` must be unique within your Platform. Promoting another Pipeline to `is_default=true` while one already exists will fail — unset the existing default first.
 
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
+        **Required permission:** `Ibl.CRM/Pipelines/action`.
       summary: Create a pipeline
       tags:
       - pipelines
@@ -40374,7 +41128,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+          description: Missing required permission `Ibl.CRM/Pipelines/action`.
   /pipelines/{pipeline_pk}/stages/:
     get:
       operationId: pipelines_stages_list
@@ -40433,7 +41187,7 @@ paths:
       description: |-
         Creates a new PipelineStage in the URL Pipeline. `code` must be unique within that Pipeline. At most one of `is_won` / `is_lost` may be true.
 
-        **Required permission:** `Ibl.CRM/Pipelines/write`.
+        **Required permission:** `Ibl.CRM/Pipelines/action`.
       summary: Create a stage
       parameters:
       - in: path
@@ -40473,7 +41227,7 @@ paths:
         '400':
           description: Validation error.
         '403':
-          description: Missing required permission `Ibl.CRM/Pipelines/write`.
+          description: Missing required permission `Ibl.CRM/Pipelines/action`.
         '404':
           description: Pipeline not found.
   /pipelines/{pipeline_pk}/stages/{id}/:
@@ -41813,6 +42567,248 @@ paths:
               schema:
                 $ref: '#/components/schemas/CheckoutSessionResponse'
           description: ''
+  /tags/:
+    get:
+      operationId: tags_list
+      description: |-
+        Returns a paginated list of Tags in your Platform. Supports filtering by `name` (case-insensitive substring) and `created_at__gte`/`created_at__lte` ISO timestamp ranges.
+
+        **Required permission:** `Ibl.CRM/Tags/list`.
+      summary: List tags
+      parameters:
+      - in: query
+        name: created_at__gte
+        schema:
+          type: string
+          format: date-time
+      - in: query
+        name: created_at__lte
+        schema:
+          type: string
+          format: date-time
+      - in: query
+        name: name
+        schema:
+          type: string
+      - name: page
+        required: false
+        in: query
+        description: A page number within the paginated result set.
+        schema:
+          type: integer
+      - name: page_size
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      tags:
+      - tags
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PaginatedTagList'
+          description: ''
+        '401':
+          description: Authentication required.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/list`.
+    post:
+      operationId: tags_create
+      description: |-
+        Creates a new Tag in your Platform. `name` must be unique within your Platform; supply `color` as a `#RRGGBB` hex string (defaults to `#888888`).
+
+        **Required permission:** `Ibl.CRM/Tags/action`.
+      summary: Create a tag
+      tags:
+      - tags
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/Tag'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '201':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '400':
+          description: Validation error (duplicate name, bad color, etc.).
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/action`.
+  /tags/{id}/:
+    get:
+      operationId: tags_retrieve
+      description: |-
+        Returns a single Tag by id.
+
+        **Required permission:** `Ibl.CRM/Tags/read`.
+      summary: Retrieve a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - tags
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/read`.
+        '404':
+          description: Tag not found.
+    put:
+      operationId: tags_update
+      description: |-
+        Replaces all editable fields on the Tag.
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Replace a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - tags
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/Tag'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/Tag'
+        required: true
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/write`.
+        '404':
+          description: Tag not found.
+    patch:
+      operationId: tags_partial_update
+      description: |-
+        Updates only the supplied fields on the Tag (typically `name` or `color`).
+
+        **Required permission:** `Ibl.CRM/Tags/write`.
+      summary: Update a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - tags
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          application/scim+json:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+          '*/*':
+            schema:
+              $ref: '#/components/schemas/PatchedTag'
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Tag'
+          description: ''
+        '400':
+          description: Validation error.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/write`.
+        '404':
+          description: Tag not found.
+    delete:
+      operationId: tags_destroy
+      description: |-
+        Deletes the Tag. All attachments to Persons, Organizations, and Deals are removed atomically via cascade.
+
+        **Required permission:** `Ibl.CRM/Tags/delete`.
+      summary: Delete a tag
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: integer
+        description: A unique integer value identifying this tag.
+        required: true
+      tags:
+      - tags
+      security:
+      - PlatformApiKeyAuthentication: []
+      responses:
+        '204':
+          description: Deleted.
+        '403':
+          description: Missing required permission `Ibl.CRM/Tags/delete`.
+        '404':
+          description: Tag not found.
   /transactions/:
     get:
       operationId: transactions_retrieve
@@ -44995,6 +45991,12 @@ components:
         * `cancelled` - Cancelled
     Deal:
       type: object
+      description: |-
+        Adds a read-only ``tags`` field to a host serializer.
+
+        Emits ``[{id, name, color}]``. Cheap when the host queryset uses
+        ``prefetch_related("tag_assignments__tag")`` — without that prefetch
+        every record triggers two extra queries.
       properties:
         id:
           type: integer
@@ -45078,6 +46080,23 @@ components:
           description: Id of the platform user responsible for this Deal (sales rep).
             Defaults to the calling user on create.
           nullable: true
+        tags:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: integer
+              name:
+                type: string
+              color:
+                type: string
+                example: '#3F6BFF'
+            required:
+            - id
+            - name
+            - color
+          readOnly: true
         metadata:
           description: Free-form JSON for Platform-defined attributes.
         created_at:
@@ -45099,6 +46118,7 @@ components:
       - platform
       - stage
       - status
+      - tags
       - title
       - updated_at
     DealLostRequest:
@@ -48416,6 +49436,12 @@ components:
       - onboarding_completed
     Organization:
       type: object
+      description: |-
+        Adds a read-only ``tags`` field to a host serializer.
+
+        Emits ``[{id, name, color}]``. Cheap when the host queryset uses
+        ``prefetch_related("tag_assignments__tag")`` — without that prefetch
+        every record triggers two extra queries.
       properties:
         id:
           type: string
@@ -48438,6 +49464,23 @@ components:
           description: Id of the Platform user who owns / manages this Organization.
             Must be an active member of your Platform.
           nullable: true
+        tags:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: integer
+              name:
+                type: string
+              color:
+                type: string
+                example: '#3F6BFF'
+            required:
+            - id
+            - name
+            - color
+          readOnly: true
         metadata:
           description: Free-form JSON for Platform-defined attributes.
         created_at:
@@ -48455,6 +49498,7 @@ components:
       - id
       - name
       - platform
+      - tags
       - updated_at
     OverTime:
       type: object
@@ -49436,6 +50480,29 @@ components:
       - next_page
       - previous_page
       - results
+    PaginatedTagList:
+      type: object
+      required:
+      - count
+      - results
+      properties:
+        count:
+          type: integer
+          example: 123
+        next:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=4
+        previous:
+          type: string
+          nullable: true
+          format: uri
+          example: http://api.example.org/accounts/?page=2
+        results:
+          type: array
+          items:
+            $ref: '#/components/schemas/Tag'
     PaginatedUserAppList:
       type: object
       required:
@@ -49793,6 +50860,12 @@ components:
             context).
     PatchedDeal:
       type: object
+      description: |-
+        Adds a read-only ``tags`` field to a host serializer.
+
+        Emits ``[{id, name, color}]``. Cheap when the host queryset uses
+        ``prefetch_related("tag_assignments__tag")`` — without that prefetch
+        every record triggers two extra queries.
       properties:
         id:
           type: integer
@@ -49876,6 +50949,23 @@ components:
           description: Id of the platform user responsible for this Deal (sales rep).
             Defaults to the calling user on create.
           nullable: true
+        tags:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: integer
+              name:
+                type: string
+              color:
+                type: string
+                example: '#3F6BFF'
+            required:
+            - id
+            - name
+            - color
+          readOnly: true
         metadata:
           description: Free-form JSON for Platform-defined attributes.
         created_at:
@@ -50494,6 +51584,12 @@ components:
           description: Whether this notification type is enabled
     PatchedOrganization:
       type: object
+      description: |-
+        Adds a read-only ``tags`` field to a host serializer.
+
+        Emits ``[{id, name, color}]``. Cheap when the host queryset uses
+        ``prefetch_related("tag_assignments__tag")`` — without that prefetch
+        every record triggers two extra queries.
       properties:
         id:
           type: string
@@ -50516,6 +51612,23 @@ components:
           description: Id of the Platform user who owns / manages this Organization.
             Must be an active member of your Platform.
           nullable: true
+        tags:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: integer
+              name:
+                type: string
+              color:
+                type: string
+                example: '#3F6BFF'
+            required:
+            - id
+            - name
+            - color
+          readOnly: true
         metadata:
           description: Free-form JSON for Platform-defined attributes.
         created_at:
@@ -50530,6 +51643,12 @@ components:
           description: Last-modified timestamp.
     PatchedPerson:
       type: object
+      description: |-
+        Adds a read-only ``tags`` field to a host serializer.
+
+        Emits ``[{id, name, color}]``. Cheap when the host queryset uses
+        ``prefetch_related("tag_assignments__tag")`` — without that prefetch
+        every record triggers two extra queries.
       properties:
         id:
           type: string
@@ -50602,6 +51721,23 @@ components:
           readOnly: true
           description: Read-only. Set to `false` when the person is linked to a platform
             user or merged into another person.
+        tags:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: integer
+              name:
+                type: string
+              color:
+                type: string
+                example: '#3F6BFF'
+            required:
+            - id
+            - name
+            - color
+          readOnly: true
         metadata:
           description: Free-form JSON for Platform-defined attributes.
         created_at:
@@ -50985,6 +52121,41 @@ components:
         platform:
           type: string
           description: The platform key
+    PatchedTag:
+      type: object
+      properties:
+        id:
+          type: integer
+          readOnly: true
+          description: Server-assigned id.
+        platform:
+          type: integer
+          readOnly: true
+          description: Platform this Tag belongs to. Set automatically from your credentials;
+            you cannot pass another Platform's id.
+        name:
+          type: string
+          description: Display label shown on tag chips. Must be unique within your
+            Platform (case-sensitive). Up to 64 characters.
+          maxLength: 64
+        color:
+          type: string
+          default: '#888888'
+          description: Hex color (e.g. `#3F6BFF`) used to render the chip. Six lowercase
+            or uppercase hex digits with a leading `#`.
+          maxLength: 7
+        metadata:
+          description: Free-form JSON for Platform-defined attributes.
+        created_at:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Creation timestamp.
+        updated_at:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Last-modified timestamp.
     PatchedUserGroup:
       type: object
       description: Serializer for UserGroups.
@@ -51938,6 +53109,12 @@ components:
       - resources
     Person:
       type: object
+      description: |-
+        Adds a read-only ``tags`` field to a host serializer.
+
+        Emits ``[{id, name, color}]``. Cheap when the host queryset uses
+        ``prefetch_related("tag_assignments__tag")`` — without that prefetch
+        every record triggers two extra queries.
       properties:
         id:
           type: string
@@ -52010,6 +53187,23 @@ components:
           readOnly: true
           description: Read-only. Set to `false` when the person is linked to a platform
             user or merged into another person.
+        tags:
+          type: array
+          items:
+            type: object
+            properties:
+              id:
+                type: integer
+              name:
+                type: string
+              color:
+                type: string
+                example: '#3F6BFF'
+            required:
+            - id
+            - name
+            - color
+          readOnly: true
         metadata:
           description: Free-form JSON for Platform-defined attributes.
         created_at:
@@ -52029,6 +53223,7 @@ components:
       - name
       - platform
       - platform_user
+      - tags
       - updated_at
     PersonInviteConflict:
       type: object
@@ -56477,6 +57672,47 @@ components:
       required:
       - display_name
       - id
+    Tag:
+      type: object
+      properties:
+        id:
+          type: integer
+          readOnly: true
+          description: Server-assigned id.
+        platform:
+          type: integer
+          readOnly: true
+          description: Platform this Tag belongs to. Set automatically from your credentials;
+            you cannot pass another Platform's id.
+        name:
+          type: string
+          description: Display label shown on tag chips. Must be unique within your
+            Platform (case-sensitive). Up to 64 characters.
+          maxLength: 64
+        color:
+          type: string
+          default: '#888888'
+          description: Hex color (e.g. `#3F6BFF`) used to render the chip. Six lowercase
+            or uppercase hex digits with a leading `#`.
+          maxLength: 7
+        metadata:
+          description: Free-form JSON for Platform-defined attributes.
+        created_at:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Creation timestamp.
+        updated_at:
+          type: string
+          format: date-time
+          readOnly: true
+          description: Last-modified timestamp.
+      required:
+      - created_at
+      - id
+      - name
+      - platform
+      - updated_at
     TenantLaunchError:
       type: object
       description: An unexpected error occurred during launch process
@@ -58789,6 +60025,15 @@ components:
           type: boolean
       required:
       - url
+    _TagAttachRequest:
+      type: object
+      properties:
+        tag_id:
+          type: integer
+          minimum: 1
+          description: Id of the Tag to attach. Must belong to your Platform.
+      required:
+      - tag_id
   securitySchemes:
     PlatformApiKeyAuthentication:
       type: apiKey