Apps can only call the OOB CSOM and REST endpoints

By Anatoly Mironov