Alpha. The app sub-resource may change shape without a deprecation cycle while apps mature. The document routes are stable.

Read the app content on the document's main (non-branch) draft — the read counterpart of PUT …/draft/app, so a caller in the draft-then-publish loop never has to track the draft identifier. Unlike the PUT sibling this never mints a draft: a document with no main draft is a 404. Writes cap the HTML at 2 MiB — apps saved before the cap may read back larger, and a body over the cap is rejected on the way back in.

A draft with no app is a 404 — including a draft that carries a dashboard, which can never carry an app.

A document carries at most one of a dashboard or an app — never both; workbook-only is valid. The app HTML and settings live only at the app sub-resource routes; the document read carries an app slice pointing here, and the whole-document PATCH accepts that slice back only as it was read.

An organization key may pass userId to act as that member: reads answer with their access, and writes are authorized and recorded as them. A user-scoped key may only name its own user (403); a user outside the organization is a 404, as is a write naming a member who has not accepted their invitation. Naming an embed user who has no live embed session is a 403. Only the operations that document userId take it — the draft-explicit …/draft/{draftIdentifier}/… routes act as the key itself.