CLI

l4 tags list

List provider and virtual tag keys with their value count, resource count, spend and share of spend.

l4 tags list prints the tag keys in your organization: the provider keys read from your AWS and GCP bills, and the virtual keys you defined. It reads GET /api/v1/tags/keys.

l4 tags list [flags]

Flags

FlagDescription
--origin <o>virtual or provider. Omit for both
--provider <p>aws or gcp. Omit for both
--search <text>Match key names. The API runs the search, so it covers every key
--start <date> / --end <date>Window for spend and share of spend. See Dates

Global flags apply. See CLI overview.

Examples

l4 tags list
l4 tags list --origin virtual
l4 tags list --provider gcp --search team
l4 tags list --start 2026-08-01 --end 2026-08-31
l4 tags list --origin virtual --jq '.data[] | select(.status == "reprocessing") | .name'

Output

Default output is a table with one row per key. Its Shadows column names the provider key a virtual key takes the place of, and reads - otherwise, because a key that shadows one changes what every other command reports for that name. With --json the whole API envelope is printed, and each row carries:

.data[].id                     # vtk_... for a virtual key, ptk_... for a provider key
.data[].name
.data[].origin                 # "virtual" or "provider"
.data[].description
.data[].providers[]            # "aws", "gcp"
.data[].value_count
.data[].resource_count
.data[].spend
.data[].spend_share_pct
.data[].status                 # virtual keys: "active", "reprocessing" or "error"
.data[].shares_provider_key    # true for a virtual key named after a provider key
.data[].values[]               # .id and .name

Errors

ExitSymptomCause
4Authentication requiredNo token resolvable; run l4 auth login or set LEVELFOUR_TOKEN
1401 authentication failedToken revoked, expired, or from the wrong environment

On this page

Ask the FinOps Agent about your cloud spend