---
title: "Favorite App"
method: PUT
path: "/api/v1/apps/{app_id}/favorite"
tags: ["apps"]
---

# Favorite App

`PUT /api/v1/apps/{app_id}/favorite`

Mark this app as a favourite for the current user (idempotent).

Per-user state, but the caller still needs VIEWER on the resource —
company membership alone would otherwise let any member toggle a
favourite on apps they cannot see, and use the 403-vs-404 response
split to enumerate app IDs across the access boundary. The
permission check runs **before** ``_load_app_or_404`` so a missing
grant collapses both "doesn't exist" and "exists but inaccessible"
into the same 403 for non-owners, matching ``get_app`` /
``get_app_bundle`` and ``PUT /projects/{project_id}/favorite``.

## Path parameters

- `app_id` string, uuid, required

## Response `200`

Successful Response

- AppRead
  - `id` string, uuid, required
  - `company_id` string, uuid, required
  - `user_id` string, uuid, required
  - `name` string, required
  - `description` string, required
  - `status` string, required
  - `bundle_url` string, nullable, required
  - `bundle_css` string, nullable, required
  - `bundle_imports` string[], nullable, required
  - `error_message` string, nullable, required
  - `chat_id` string, uuid, nullable, required
  - `current_version_id` string, uuid, nullable, required
  - `draft_version_id` string, uuid, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `bindings` BindingRead[]
    - `id` string, uuid, required
    - `entity_id` string, uuid, required
    - `mode` string, required
  - `is_favorite` boolean

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/netter/apis/dmi-backend.md) · [All operations](https://skmtc.net/netter/apis/dmi-backend/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/netter/dmi-backend/versions/a59877bf911b/schema)