App_metadata not merged but replaced

There is a log of the request. If you go to your logs you should see the request and who/what app made it. For example:

{
  "date": "2021-08-11T19:05:55.349Z",
  "type": "sapi",
  "description": "Update a User",
  "client_id": "xxxxx",
  "client_name": "xxxxx",
  "details": {
    "request": {
      "method": "patch",
      "path": "/api/v2/users/xxxxx",
      "query": {},
      "body": {
        "app_metadata": {
          "foo": "bar"
        }
      },
      "channel": "https://manage.auth0.com/",
      "auth": {
        "user": {
          "user_id": "xxxxx",
          "name": "xxxxx",
          "email": "xxxxx"
         }
       }
//...etc...
}

You can also search the logs, which should help you narrow down the requests that are clearing the app metadata.