---
title: "Api App State Put"
method: POST
path: "/api/apps/public/{token}/state"
tags: ["apps"]
---

# Api App State Put

`POST /api/apps/public/{token}/state`

## Request

- Base URL: `https://app.getdot.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.getdot.ai/api/apps/public/{token}/state`
- Auth: one of:
  - API key in header `X-API-KEY`
  - API key in cookie `Authorization`
  - OAuth 2 (password, token URL `/api/auth/token`)

Merge a patch into this viewer's saved state for this app (ENG-1143).

POST with a `text/plain` body on purpose: the caller is a sandboxed frame,
whose opaque origin makes every request cross-origin. A PUT or a JSON
content-type would trigger a CORS preflight, and answering preflights would
mean opening methods and headers on a token-gated public endpoint. This
shape is a "simple request" — no preflight to answer, no CORS surface added,
and it is what `navigator.sendBeacon` can send as the page goes away.

Body: `{"patch": {...}, "remove": ["key", ...]}`. A patch rather than a
whole document so two tabs of the same app cannot delete each other's keys.

## Path parameters

- `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/getdot/apis/dot-api-2.md) · [All operations](https://skmtc.dev/getdot/apis/dot-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/getdot/apis/dot-api-2/revisions/d26fe7163a7f?raw)