---
title: "GET /v3/tagKeys/{tagKeysId}"
method: GET
path: "/v3/tagKeys/{tagKeysId}"
tags: ["tagKeys"]
---

# GET /v3/tagKeys/{tagKeysId}

`GET /v3/tagKeys/{tagKeysId}`

## Request

- Base URL: `https://cloudresourcemanager.googleapis.com`
- URL: `https://cloudresourcemanager.googleapis.com/v3/tagKeys/{tagKeysId}`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform.read-only`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform.read-only`

Retrieves a TagKey. This method will return `PERMISSION_DENIED` if the key does not exist or the user does not have permission to view it.

## Path parameters

- `tagKeysId` string, required

## Response `200`

Successful response

- TagKey: A TagKey, used to group a set of TagValues.
  - `allowedValuesRegex` string: Optional. Regular expression constraint for freeform tag values. If present, it implicitly allows freeform values (constrained by the regex).
  - `createTime` string, google-datetime: Output only. Creation time.
  - `description` string: Optional. User-assigned description of the TagKey. Must not exceed 256 characters. Read-write.
  - `etag` string: Optional. Entity tag which users can pass to prevent race conditions. This field is always set in server responses. See UpdateTagKeyRequest for details.
  - `name` string: Immutable. The resource name for a TagKey. Must be in the format `tagKeys/{tag_key_id}`, where `tag_key_id` is the generated numeric id for the TagKey.
  - `namespacedName` string: Output only. Immutable. Namespaced name of the TagKey.
  - `parent` string: Immutable. The resource name of the TagKey's parent. A TagKey can be parented by an Organization or a Project. For a TagKey parented by an Organization, its parent must be in the form `organizations/{org_id}`. For a TagKey parented by a Project, its parent can be in the form `projects/{project_id}` or `projects/{project_number}`.
  - `purpose` 'PURPOSE_UNSPECIFIED' | 'GCE_FIREWALL' | 'DATA_GOVERNANCE': Optional. A purpose denotes that this Tag is intended for use in policies of a specific policy engine, and will involve that policy engine in management operations involving this Tag. A purpose does not grant a policy engine exclusive rights to the Tag, and it may be referenced by other policy engines. A purpose cannot be changed once set.
  - `purposeData` object: Optional. Purpose data corresponds to the policy system that the tag is intended for. See documentation for `Purpose` for formatting of this field. Purpose data cannot be changed once set.
  - `shortName` string: Required. Immutable. The user friendly name for a TagKey. The short name should be unique for TagKeys within the same tag namespace. The short name must be 1-256 characters, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between.
  - `updateTime` string, google-datetime: Output only. Update time.

## Changes

- **2026-11-03** `9e107eeb58df`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/cloud-platform.read-only` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform.read-only` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/cloudresourcemanager/changes/v3/tagKeys/:tagKeysId/get.md)

---

[API](https://skmtc.dev/google/apis/cloudresourcemanager.md) - [All operations](https://skmtc.dev/google/apis/cloudresourcemanager/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/cloudresourcemanager/revisions/9e107eeb58df?raw)