API/CLI - how to access subset of devices by tag assigned to them?

[DDmchk]

Hi there, 
I'm going to use device's tags to have another dimension beside of template/device groups. 
I've assigned a tag to subset of devices (using Panorama>Managed devices WebUI), but I'm really lost how I can get access/filter devices by this tag in CLI/API (except WebUI  - search/filter them on or when selecting scope to push). 
When I'm using Panorama XML API to get all connected devices, I didn't get any mention of the tag in response text. 
I've also looked into CLI commands that will show the tag assigned, but found only commands related to traffic tagging, not device tags.
Any idea how to get this done on CLI/API?
P.S. Panorama running PanOS 10.0.7

[nikoolayy1]

You may play with shared objects Manage Unused Shared Objects (paloaltonetworks.com)

You may also configure the firewall locally and import it:

How to add a locally managed firewall to panorama management (paloaltonetworks.com)

Still good to note is that better make a template stack with templates that you use on every firewall and then more specific ones specifically for firewalls

Templates and Template Stacks (paloaltonetworks.com)

Device Group Hierarchy (paloaltonetworks.com)

[KennySwetnam]

This is probably far too late of a response. But I was searching for the same thing and ultimately used the web-mgmt interface debug to find it:

CLI
From configure - show mgt-config devices <serial number> vsys vsys1 tag
API
/api/?type=config&action=get&xpath=/config/mgt-config/devices/entry[@name='<serial_number>']/vsys/entry[@name='vsys1']/tags