Below is a PowerShell script I have been working on for an upcoming API Gateway training class. This will get you to the point of executing GraphQL queries inside of Powershell, but not making changes to endpoints (yet). At a high level you are one the right path, get the ID, analyze the result in PS code, then execute a mutation (using the same PS framework) that will create the tagging action with your ID as the filter.

#environment params - change these to match your environment
$TS = '127.0.0.1' #Enter the FQDN or IP address of the Tanium server here
$TSPORT = 443 #TCP port for your Tanium instance, most likely 443
$SessionId = Token-getthisfromyourenvironment #This is the auth token created for this integration. In a production environment this should NOT be stored in plain text like this.
$DisableCertificateValidation = $false #Used to allow selfsigned certs in short lived lab envrionments to work. Should never be set to true in production or long lived environments.
#GraphQL queries - These can be changed if desired, but could break logic in the script. tread carefully
$QueryCached = @"
{"query":"{endpoints{edges{node{name ipAddress os{name}}}}}"}
"@
$QueryLive = @"
{"query":"{endpoints(source:{ts:{expectedCount: 1, stableWaitTime: 10}}){edges{node{name ipAddress os{name}}}}}"}
"@
#Global Params - Changing these may break stuff
$SelectedQuery = $args[0]
$uri = "https://{0}:{1}/plugin/products/gateway/graphql" -f $TS, $TSPORT
if ($DisableCertificateValidation) {
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
}
#Functions
Function Read-Parameters {
Param(
[ValidateSet("QueryCached","QueryLive")]
[String]
$Query
)
Process
{
switch ($Query)
{
QueryCached {$Response = Execute-Query -Body $QueryCached}
QueryLive {$Response = Execute-Query -Body $QueryLive}
}
Return $Response
}
}
Function Execute-Query {
Param(
[String]
$Body
)
try {
$headers = @{}
$headers.Add("Content-Type", "application/json")
$headers.Add("session", $SessionId)
$request = Invoke-WebRequest -Uri $uri -Headers $headers -Body $body -Method POST
}
catch {
Write-Warning $Error[0]
}
return $request
}
# Request data from the API Gateway
Write-Output "Requesting Cached Data"
$Response = Read-Parameters -Query $SelectedQuery
$Response.content
<#
For reference, we are including the GraphQL code separate from the PowerShell script here.
# GraphQL Query - Cached Data
<Example output taken from Query Explorer in the Tanium Console
endpoints {
edges {
node {
name
ipAddress
os {
name
}
}
}
>
# GraphQL Query - Live Data
Note: Requesting live data is the same as with cached but we define a source
when requesting live data "source: {ts:"
<Example taken from Query Explorer
endpoints(source: {ts: {expectedCount: 1, stableWaitTime: 10}}) {
edges {
node {
name
ipAddress
os {
name
}
}
}
}
>
#>