point to apps for dmain restrictions on json