Alpha. The app sub-resource may change shape without a deprecation cycle while apps mature. The document routes are stable.

Create (or reuse) the document's main draft and apply targeted app edits in one call — the PATCH counterpart of PUT …/draft/app, with the same body and all-or-nothing semantics as PATCH …/draft/{draftIdentifier}/app. Never creates the app: a document with no published app is a 409, checked before any draft is minted.

Content addressing buys sequential staleness detection, not concurrency safety: if the text an edit targets moved between your read and your write, the edit fails to match and nothing is applied. There is no version precondition, compare-and-swap, or lock behind it, so two writers patching the same app at the same time can still overwrite each other, orthogonal edits included — serialize writes to one app when that matters.

A document carries at most one of a dashboard or an app — never both; workbook-only is valid. The app HTML and settings live only at the app sub-resource routes; the document read carries an app slice pointing here, and the whole-document PATCH accepts that slice back only as it was read.

An organization key may pass userId to act as that member: reads answer with their access, and writes are authorized and recorded as them. A user-scoped key may only name its own user (403); a user outside the organization is a 404, as is a write naming a member who has not accepted their invitation. Naming an embed user who has no live embed session is a 403. Only the operations that document userId take it — the draft-explicit …/draft/{draftIdentifier}/… routes act as the key itself.