Skip to content
Narvy

ITMS-91053: Missing API declaration in the privacy manifest

A binary in your app calls an API Apple lists as "required reason" (for example UserDefaults, stat, mach_absolute_time, disk space keys), and the privacy manifest of the bundle that contains it does not declare that category. Add the category with an approved reason code to PrivacyInfo.xcprivacy, in the right bundle.

App Store Connect e-mailITMS-91053
ITMS-91053: Missing API declaration - Your app's code in the "<file>" file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults.

What it means

Starting May 1, 2024, apps that don't describe their use of required reason API in their privacy manifest file aren't accepted by App Store Connect.

Apple, Describing use of required reason API

Five categories exist: file timestamps, system boot time, disk space, active keyboards and user defaults. Each declared category needs at least one reason code from Apple's list (for user defaults, CA92.1 means access by the app itself). Apple requires the declaration for each executable or dynamic library: the bundle that contains it needs its own manifest, so a framework cannot rely on the app's file.

Deadline

In force since May 1, 2024 for new apps and app updates.

How to fix it

1. Find the category and the binary

The e-mail names the file and the categories. The store check reads the imported symbols of every executable in the IPA and lists, per binary, the undeclared category and the symbols that require it.

2. Declare it with an approved reason

PrivacyInfo.xcprivacy (in the app target, or in the framework that uses the API)
<key>NSPrivacyAccessedAPITypes</key>
<array>
  <dict>
    <key>NSPrivacyAccessedAPIType</key>
    <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
    <key>NSPrivacyAccessedAPITypeReasons</key>
    <array>
      <string>CA92.1</string>
    </array>
  </dict>
</array>

In Xcode: File, New, File, App Privacy. Pick the reason code that matches the real use from Apple's list; the reason is a code, not free text.

3. Fix third-party frameworks at the source

If the category is missing in a framework's own bundle, upgrade the SDK to a release that ships a privacy manifest. Declaring it in your app's manifest does not cover a separate dynamic framework.

Check before you submit

Upload the IPA on the store check page. It runs APPSTORE-REQUIRED-REASON-API against the dates on this page, then deletes the file: nothing about the app is kept. The same engine runs offline in the Narvy CLI, and exits with code 1 when a blocker is found, so it can gate a CI job.

Offline, from a terminal (narvy-cli 1.2.0 or later)
narvy store-check MyApp.ipa

Check a build in the browser

FAQ

Why does the store check report a warning and not a blocker?

Apple's scanner is not public, and App Store apps with undeclared imports exist, so a rejection cannot be predicted with certainty. Apple's documentation is clear that the declaration is required.

What does "not determined" mean for this check?

Some APIs (systemUptime, activeInputModes, fileModificationDate) are reached by Objective-C message name. The binary proves the message is sent, not to which class, so the check lists it for review instead of failing.