Privacy manifest required reason API rejection: how to fix it
What the required reason API rule means
Since May 1, 2024, an app that calls one of Apple's required reason APIs has to declare an approved reason for it in a privacy manifest. The manifest is a file named PrivacyInfo.xcprivacy, and the declarations live in an array called NSPrivacyAccessedAPITypes. Each entry pairs an API category with one or more approved reason codes from Apple's published list.
The flagged categories include:
- File timestamp APIs.
- System boot time APIs.
- Disk space APIs.
- User defaults APIs.
When a required reason API is used without a matching declaration, App Store Connect raises the issue at upload, often as the ITMS-91053 message that names the specific category it detected. The full rules are in Apple's guide to describing use of required reason API.
Why it happens
- The app uses a required reason API, like user defaults, but the project has no PrivacyInfo.xcprivacy file.
- A privacy manifest exists but does not declare every category the binary uses.
- A third-party SDK calls a required reason API and ships a version that predates privacy manifests.
- A new dependency added a flagged API the project did not use before, so an older manifest is now incomplete.
The common thread is that the binary touches a required reason API without an approved reason on record for it.
How to fix it
- Read which categories were flagged. The App Store Connect message lists the API category names. Note each one.
- Add a privacy manifest. In Xcode, add a new file of type App Privacy File, which is named PrivacyInfo.xcprivacy, in your app target.
- Declare each flagged category. Under NSPrivacyAccessedAPITypes, add an entry for each category and pick the approved reason code that matches your actual use, from Apple's privacy manifest documentation.
- Handle SDK-sourced hits. If a flagged API comes from a third-party SDK, update to a version that bundles its own privacy manifest. Apple's third-party SDK requirements list the SDKs expected to ship one. Do not declare another vendor's reasons in your manifest.
- Pick reason codes honestly. The reason has to reflect how your app actually uses the API. Re-archive and re-upload once the declarations are correct.
How AppFlight helps
AppFlight generates native iOS apps in Swift and SwiftUI and handles the upload and submission flow, so the privacy manifest is part of the build path rather than a file you have to remember to add by hand. Because AppFlight knows which integrations it wired in, such as analytics, crash reporting, and paywalls, it has the context to keep those declarations accurate. This is an upload-time check, and AppFlight reads the error, works on the missing declaration or the outdated SDK, and re-submits. AppFlight does not guarantee approval. The manifest still has to be correct, and Apple reviews every app after the upload checks pass.
FAQ
What is a required reason API?
It is one of a set of common system APIs that have been used in the past to fingerprint devices, such as file timestamp, system boot time, disk space, and user defaults APIs. Apple requires you to declare an approved reason for using each one in a privacy manifest.
Do I need a privacy manifest even if I do not track users?
Yes, if your app or any included SDK calls a required reason API. The declaration is about why you use the API, not only about tracking. You pick an approved reason code that matches your actual use, even for ordinary, non-tracking functionality.
What if the flagged API is in a third-party SDK?
Many of these hits come from SDKs. The vendor should ship its own privacy manifest, so update to a version that includes one. You declare reasons only for the APIs your own code uses, not another vendor's.