Apps can only call the OOB CSOM and REST endpoints