ITMS-91053 missing API declaration: what it means and how to fix it
What the error means
Apple defines a set of required reason APIs: common system APIs that have been used in the past to fingerprint devices. Since May 1, 2024, an app that calls one of these APIs has to declare an approved reason for it in a privacy manifest file. ITMS-91053 is the error App Store Connect returns when a build uses one of these APIs but does not include that declaration.
The flagged APIs fall into categories such as:
- File timestamp APIs.
- System boot time APIs.
- Disk space APIs.
- User defaults APIs.
The ITMS-91053 email names the specific category or categories it detected. The declaration goes in a file named PrivacyInfo.xcprivacy, in an array called NSPrivacyAccessedAPITypes, where each entry pairs an API category with one or more approved reason codes from Apple's list. Full details are in Apple's guide to describing use of required reason API.
How to fix it
- Read which categories were flagged. The ITMS-91053 message lists the API category names. Note each one.
- Add a privacy manifest. In Xcode, add a new file of type App Privacy File, which is named PrivacyInfo.xcprivacy. This is the required name for a bundled manifest, and it should be in your app target.
- Declare each flagged category. Under NSPrivacyAccessedAPITypes, add an entry for each category from the email and pick the approved reason code that matches why your app uses it, from Apple's privacy manifest documentation.
- Handle SDK-sourced hits. If a flagged API comes from a third-party SDK, update to a version that bundles its own privacy manifest. Apple's third-party SDK requirements list the SDKs expected to ship one. Do not declare another vendor's reasons in your manifest.
- Re-archive and re-upload. The error clears once the build includes the correct declarations.
How to avoid it
- Add a PrivacyInfo.xcprivacy to new projects from the start, and keep it updated as you add APIs.
- Keep third-party SDKs current, since vendors add their manifests over time and older versions are a common source of this error.
- Pick reason codes honestly. The reason has to reflect how your app actually uses the API, and using an API for tracking when you declared a non-tracking reason is not allowed.
- Re-check after adding any new dependency, because a new SDK can introduce a flagged API you were not using before.
How AppFlight helps
AppFlight generates native iOS apps in Swift and SwiftUI and handles the upload and submission flow, so the privacy manifest is part of the build path rather than a file you have to remember to add by hand. Because AppFlight knows which integrations it wired in, such as analytics, crash reporting, and paywalls, it has the context to keep those declarations accurate. ITMS-91053 is an upload-time check, and AppFlight reads the error, works on the missing declaration or the outdated SDK, and re-submits. AppFlight does not guarantee approval. The privacy manifest still has to be correct, and Apple reviews every app after the upload checks pass.
FAQ
What is ITMS-91053?
It is an App Store Connect warning or rejection that fires when your binary uses one of Apple's required reason APIs but does not declare an approved reason in a privacy manifest. The email lists the specific API categories that are missing a declaration.
Is ITMS-91053 a review rejection?
It is an upload-time check from App Store Connect, raised when you submit the build, before human review. Since May 1, 2024, App Store Connect does not accept apps that use required reason APIs without declaring them, so you have to resolve it to get the build through.
What if the flagged API is in a third-party SDK, not my code?
Many ITMS-91053 hits come from SDKs. The SDK vendor should ship its own privacy manifest. Update to a version that includes one, or if it is your own framework, add the declaration there. You declare reasons for the APIs your own code uses in your app's PrivacyInfo.xcprivacy.