dynamically add _tagged_ VLAN to switch port?

Hello,

on system with switch rules (CRS328, RouterOS 7) is there any possible way to dynamically add a tagged VLAN to some port, additionally to untagged one as configured statically, after dot1X authentication? Or some scripting based solution?
The only way I see at the moment that maybe could work is to you the API from an external system (or now a docket container).

Any idea for a preferable simple solution?

thanks