ITMS-91055: Invalid API reason declaration

Privacy & Security General
Simone Pasetto OP
Created
Replies 2
Boosts 1
Views 3.1k
Participants 3

in this weeks i received this error:

ITMS-91055: Invalid API reason declaration - The PrivacyInfo.xcprivacy for the “VanigliaPro” file contains “App Functionality” as the value for a NSPrivacyAccessedAPITypeReasons key instead of a valid reason code for using an API in the NSPrivacyAccessedAPICategoryFileTimestamp category. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, values for NSPrivacyAccessedAPITypeReasons keys in your app’s privacy manifest must be valid reason codes for the corresponding API category. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

ITMS-91053: Missing API declaration - Your app’s code in the “xxxx” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

ITMS-91053: Missing API declaration - Your app’s code in the “xxxx” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryFileTimestamp. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

any help for make correct privacy file?

Replies  2
Boosts 1
Views  3.1k
Participants  3
vk-softwarecountry OP

Hi, there is video from WWDC with general explanation and examples of privacy manifest https://developer.apple.com/wwdc23/10060

but there is more general question for Apple to clarify: many libraries consider this issue as addressed by adding empty PrivacyInfo.xcprivacy without specifying NSPrivacyAccessedAPIType and NSPrivacyAccessedAPITypeReasons, for example https://github.com/flutter/packages/pull/5846/files?file-filters%5B%5D=.xcprivacy&show-viewed-files=true - it's really confusing as it shouldn't be working "fix" or I totally misunderstood logic behind adding these files (in my opinion they should follow same logic as we used previously with eg Photos or Location access - you declare privacy data type and provide description).
peter_zhang OP

The value must be a code, not a description. "App Functionality" is App Store privacy-label wording; in PrivacyInfo.xcprivacy the NSPrivacyAccessedAPITypeReasons array takes the exact reason codes from Apple's table for that API category - for NSPrivacyAccessedAPICategoryUserDefaults the only valid one is CA92.1, and NSPrivacyAccessedAPICategoryFileTimestamp has its own set (C617.1 for timestamps of files inside your app's container, among others).

Also worth knowing, because it turns a one-line fix into weeks of confusion: a plausible but nonexistent code (say CA92.2) passes every local check - Xcode accepts it, archiving succeeds - and fails only at App Store submission verification with exactly this ITMS-91055. So copy the category-to-code pairs from the documentation table rather than picking what sounds right, then diff every entry of every PrivacyInfo.xcprivacy (app target and extensions) against that table. That same diff closes the ITMS-91053s in the mail: the UserDefaults and FileTimestamp APIs your code touches need NSPrivacyAccessedAPITypes entries carrying those same valid codes.