Alpha. The app sub-resource may change shape without a deprecation cycle while apps mature. The document routes are stable.

Read the published app content: the full HTML plus settings. This is the only endpoint that returns the HTML body; the document GET carries only the app slice. Writes cap the HTML at 2 MiB — apps saved before the cap may read back larger. This reads the published app; an existing draft may have diverged, so read the draft state before building a draft write from this response. Gated on view access to the app, the same bar as the app page: a viewer-role share passes even when the document withholds the workbook from viewers, unlike the document GET and the draft app reads, which require workbook read access.

A document carries at most one of a dashboard or an app — never both; workbook-only is valid. The app HTML and settings live only at the app sub-resource routes; the document read carries an app slice pointing here, and the whole-document PATCH accepts that slice back only as it was read.

An organization key may pass userId to act as that member: reads answer with their access, and writes are authorized and recorded as them. A user-scoped key may only name its own user (403); a user outside the organization is a 404, as is a write naming a member who has not accepted their invitation. Naming an embed user who has no live embed session is a 403. Only the operations that document userId take it — the draft-explicit …/draft/{draftIdentifier}/… routes act as the key itself.