This looks pretty ugly. It would be a lot more user friendly to:
  • eliminate the /groups/<groupID>/ portion of the URL entirely - the app ID already uniquely identifies the group anyway
  • use the clientAppID instead of the raw objectID for /apps/<appID>.
For example, the above URL could instead be represented as
with no loss of functionality or precision