Parkin, the URL has the "add" and the tag ID transposed.
Should be: .../rest/vulnerabilities/{vulnerabilityId}/tags/add/{tagId}
Reference: https://denimgroup.atlassian.net/wiki/spaces/TDOC/pages/374964278/Add+Tag+to+Vulnerability+-+API
Please let us know which ThreadFix customer/prospect you are representing, so we can route any future issues/questions that you may have to the appropriate support channel...this medium is not regularly monitored and is no longer the preferred method of contacting us for support.
Thanks,
Hector Ruiz
Denim Group