diff --git a/frontend/app/scripts/services/api/TagSrv.js b/frontend/app/scripts/services/api/TagSrv.js
index 44044433a1..33fdf049f9 100644
--- a/frontend/app/scripts/services/api/TagSrv.js
+++ b/frontend/app/scripts/services/api/TagSrv.js
@@ -8,9 +8,7 @@
             var getTags = function(objectType, term) { // TODO remove objectType parameter (not used anymore)
                 var defer = $q.defer();
                 QuerySrv.call('v0', [
-                    { _name: 'listTag' },
                     { _name: 'autoComplete', freeTag: term, limit: 10 },
-                    { _name: 'text' }
                 ], {name: 'tags-auto-complete'})
                     .then(function(data) {
                         defer.resolve(_.map(_.unique(data), function(tag) {
diff --git a/thehive/app/org/thp/thehive/controllers/v0/TagCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/TagCtrl.scala
index 58ac256022..616e85fab9 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/TagCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/TagCtrl.scala
@@ -104,8 +104,9 @@ case class TagHint(freeTag: Option[String], namespace: Option[String], predicate
 
 @Singleton
 class PublicTag @Inject() (tagSrv: TagSrv, organisationSrv: OrganisationSrv) extends PublicData {
-  override val entityName: String  = "tag"
-  override val initialQuery: Query = Query.init[Traversal.V[Tag]]("listTag", (graph, _) => tagSrv.startTraversal(graph))
+  override val entityName: String = "tag"
+  override val initialQuery: Query =
+    Query.init[Traversal.V[Tag]]("listTag", (graph, authContext) => tagSrv.startTraversal(graph).visible(authContext))
   override val pageQuery: ParamQuery[OutputParam] = Query.withParam[OutputParam, Traversal.V[Tag], IteratorOutput](
     "page",
     (range, tagSteps, _) => tagSteps.page(range.from, range.to, withTotal = true)
@@ -120,15 +121,16 @@ class PublicTag @Inject() (tagSrv: TagSrv, organisationSrv: OrganisationSrv) ext
     Query[Traversal.V[Tag], Traversal.V[Tag]]("fromCase", (tagSteps, _) => tagSteps.fromCase),
     Query[Traversal.V[Tag], Traversal.V[Tag]]("fromObservable", (tagSteps, _) => tagSteps.fromObservable),
     Query[Traversal.V[Tag], Traversal.V[Tag]]("fromAlert", (tagSteps, _) => tagSteps.fromAlert),
-    Query.withParam[TagHint, Traversal.V[Tag], Traversal.V[Tag]](
+    Query.initWithParam[TagHint, Traversal[String, Vertex, Converter[String, Vertex]]](
       "autoComplete",
-      (tagHint, tags, authContext) =>
+      (tagHint, graph, authContext) =>
         tagHint
           .freeTag
-          .fold(tags.autoComplete(tagHint.namespace, tagHint.predicate, tagHint.value)(authContext))(
-            tags.autoComplete(organisationSrv, _)(authContext)
+          .fold(tagSrv.startTraversal(graph).autoComplete(tagHint.namespace, tagHint.predicate, tagHint.value)(authContext).visible(authContext))(
+            tagSrv.startTraversal(graph).autoComplete(organisationSrv, _)(authContext)
           )
           .merge(tagHint.limit)(_.limit(_))
+          .displayName
     ),
     Query[Traversal.V[Tag], Traversal[String, Vertex, Converter[String, Vertex]]]("text", (tagSteps, _) => tagSteps.displayName),
     Query.output[String, Traversal[String, Vertex, Converter[String, Vertex]]]
@@ -139,20 +141,12 @@ class PublicTag @Inject() (tagSrv: TagSrv, organisationSrv: OrganisationSrv) ext
     .property("value", UMapping.string.optional)(_.field.readonly)
     .property("description", UMapping.string.optional)(_.field.readonly)
     .property("text", UMapping.string)(
-      _.select(_.displayName) // FIXME add filter
-//        .filter((_, tags) =>
-//          tags
-//            .graphMap[String, String, Converter.Identity[String]](
-//              { v =>
-//                val namespace = UMapping.string.getProperty(v, "namespace")
-//                val predicate = UMapping.string.getProperty(v, "predicate")
-//                val value     = UMapping.string.optional.getProperty(v, "value")
-//                Tag(namespace, predicate, value, None, "#000000").toString
-//              },
-//              Converter.identity[String]
-//            )
-//        )
-//        .converter(_ => Converter.identity[String])
+      _.select(_.displayName)
+        .filter[String] {
+          case (_, tags, authContext, Right(predicate)) => tags.freetags(organisationSrv)(authContext).has(_.predicate, predicate)
+          case (_, tags, _, Left(true))                 => tags
+          case (_, tags, _, Left(false))                => tags.empty
+        }
         .readonly
     )
     .build
diff --git a/thehive/app/org/thp/thehive/services/TagSrv.scala b/thehive/app/org/thp/thehive/services/TagSrv.scala
index 6c33f0816d..f67baca12a 100644
--- a/thehive/app/org/thp/thehive/services/TagSrv.scala
+++ b/thehive/app/org/thp/thehive/services/TagSrv.scala
@@ -77,12 +77,16 @@ object TagOps {
 
     def fromAlert: Traversal.V[Tag] = traversal.filter(_.in[AlertTag])
 
-    def autoComplete(organisationSrv: OrganisationSrv, freeTag: String)(implicit authContext: AuthContext): Traversal.V[Tag] = {
+    def freetags(organisationSrv: OrganisationSrv)(implicit authContext: AuthContext): Traversal.V[Tag] = {
       val freeTagNamespace: String = s"_freetags_${organisationSrv.currentId(traversal.graph, authContext).value}"
       traversal
         .has(_.namespace, freeTagNamespace)
-        .has(_.predicate, TextP.containing(freeTag))
     }
+
+    def autoComplete(organisationSrv: OrganisationSrv, freeTag: String)(implicit authContext: AuthContext): Traversal.V[Tag] =
+      freetags(organisationSrv)
+        .has(_.predicate, TextP.containing(freeTag))
+
     def autoComplete(namespace: Option[String], predicate: Option[String], value: Option[String])(implicit
         authContext: AuthContext
     ): Traversal.V[Tag] = {