"/apps/browser/{activityId}":
    parameters:
        - in: path
          name: activityId
          required: true
          schema: { type: string }
    get:
        tags: [Browser sharing]
        operationId: getSharedBrowserActivity
        summary: Read shared-browser activity (website)
        description: |
            Returns the current state of a shared-browser activity — the URL being
            shared, viewer count, etc. Authenticated by the **website** bearer
            (`website-cloud-api`); the website calls this to render the
            companion-screen UI without VR-client credentials.
        security:
            - websiteApiKey: []
              cloudAccessToken: []
        responses:
            "200":
                description: Shared-browser activity payload.
                content:
                    application/json:
                        schema:
                            type: object
                            properties:
                                activityId: { type: string }
                                url: { type: string, format: uri }
                                hyperbeamSessionUrl: { type: string, format: uri }
                                viewerCount: { type: integer }
                                ownerSocialId: { type: string }
                                createdAt: { type: string, format: date-time }
                            additionalProperties: true
            "401": { $ref: "../cloud-api.yaml#/components/responses/Unauthorized" }
            "404":
                description: No activity with this id.
                content:
                    application/json:
                        schema: { $ref: "../cloud-api.yaml#/components/schemas/Error" }
    put:
        tags: [Browser sharing]
        operationId: updateSharedBrowserSettings
        summary: Update shared-browser settings (Unity)
        description: |
            Updates the shared-browser activity's settings — typically the URL the
            session navigates to. Authenticated by the standard VR-client bearer.
        security:
            - cloudApiKey: []
              cloudAccessToken: []
        requestBody:
            required: true
            content:
                application/json:
                    schema:
                        type: object
                        properties:
                            url: { type: string, format: uri }
                            settings:
                                type: object
                                additionalProperties: true
        responses:
            "200":
                description: Updated activity.
                content:
                    application/json:
                        schema: { $ref: "../components/schemas/Activity.yaml" }
            "401": { $ref: "../cloud-api.yaml#/components/responses/Unauthorized" }
            "403":
                description: Caller is not the activity owner.
                content:
                    application/json:
                        schema: { $ref: "../cloud-api.yaml#/components/schemas/Error" }
            "404":
                description: No activity with this id.
                content:
                    application/json:
                        schema: { $ref: "../cloud-api.yaml#/components/schemas/Error" }
