Job can be launched on any (so private) app
There is no control on the user-app relation when a job is submitted through the API jobs.
In api/v1/views.py, this is where to act
if request.POST['job[webapp_id]'].isdigit():
app = Webapp.objects.filter(id=request.POST['job[webapp_id]']).first()
else:
app = Webapp.objects.filter(name=request.POST['job[webapp_id]']).first()