Alpha. The app sub-resource may change shape without a deprecation cycle while apps mature. The document routes are stable.

Replace the app HTML on an existing draft — creating the app when the draft is workbook-only — optionally replacing the app settings in the same call. Operates only on the draft named by draftIdentifier, which the caller creates first via PATCH …/draft; a published app is never addressable for writing, so every edit is draft-then-publish by construction. No auto-publish — publish via POST …/draft/publish.

Last-write-wins, like every app write in the UI: the body is applied as given, with no expected-version precondition. Every write appends an immutable app_history revision, so nothing is lost — only the head moves.

Writes never reject on app policy. External <script src>, <link rel="stylesheet">, <img src>, and <video> / <audio> / <source src> hosts outside the organization’s app policy (resolved over the settings this write produces) come back as non-blocking warnings — the render-time CSP is the enforcement, and a disallowed host is inert until an org admin allows it. The same array warns when settings.allowDefaultMapProviders is on but the organization turns map providers off for every app, or settings.allowModals is on but the organization turns printing and dialogs off, or settings.allowFullscreen is on but the organization turns app-triggered full screen off, or settings.allowClipboard is on but the organization turns the clipboard off, or settings.allowDownloads is on but the organization turns downloads off, or settings.navAllowedDomains names hosts outside the organization’s navigation policy; the setting persists and does nothing until an admin allows it.

A document carries at most one of a dashboard or an app — never both; workbook-only is valid. The app HTML and settings live only at the app sub-resource routes; the document read carries an app slice pointing here, and the whole-document PATCH accepts that slice back only as it was read.