XCFramework Doctor Join the pilot

App Store Connect error

ITMS-91053: Missing API declaration

App Store Connect sends this email when a binary in your app uses a required-reason API and no privacy manifest in the app declares why. Most of the time the binary is a third-party SDK, not your own code.

What the email says

It names an API category, for example NSPrivacyAccessedAPICategoryUserDefaults or NSPrivacyAccessedAPICategoryFileTimestamp, and asks you to add a PrivacyInfo.xcprivacy file that declares an approved reason. It doesn't say which framework triggered it.

The five categories and what triggers them

File timestamp

stat, fstat, lstat, getattrlist, NSFileModificationDate, NSURLCreationDateKey, NSURLContentModificationDateKey. Reasons: DDA9.1, C617.1, 3B52.1, 0A2A.1.

System boot time

mach_absolute_time, systemUptime. Reasons: 35F9.1, 8FFB.1, 3D61.1.

Disk space

statfs, statvfs, NSFileSystemFreeSize, NSURLVolumeAvailableCapacityKey and related keys. Reasons: 85F4.1, E174.1, 7D9E.1, B728.1.

Active keyboards

activeInputModes. Reasons: 3EC4.1, 54BD.1.

User defaults

NSUserDefaults / UserDefaults. Reasons: CA92.1, 1C8F.1, C56D.1, AC6B.1.

Pick the reason codes that match what the code actually does; Apple's "Describing use of required reason API" page defines each one.

If you're the app developer

  1. Find the binary. On each framework in your build, run nm -u -j and look for the symbols above, then check whether that framework's PrivacyInfo.xcprivacy declares the category. We'll scan an SDK for free if you'd rather not.
  2. Update the SDK. Most vendors shipped manifests in 2024. If the latest release still lacks the declaration, Apple's guidance is to contact the vendor.
  3. Your own code: add PrivacyInfo.xcprivacy to the app target with an NSPrivacyAccessedAPITypes entry for the category.
<key>NSPrivacyAccessedAPITypes</key>
<array>
  <dict>
    <key>NSPrivacyAccessedAPIType</key>
    <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
    <key>NSPrivacyAccessedAPITypeReasons</key>
    <array><string>CA92.1</string></array>
  </dict>
</array>

If you ship the SDK

Your customers get the email, not you. A manifest that was right in 2024 drifts: a new dependency calls stat(), a refactor adds UserDefaults. On 3 November 2026, 4 of 6 current public SDK releases we scanned had a required-reason reference their manifest didn't declare.

XCFramework Doctor scans the compiled .xcframework, slice by slice, against its manifest and fails your release build before the binary reaches a customer.

Become a pilot vendor See a real report →