App Attest attestationData request fails with 400 Bad Request (no X-Request-ID)

Question

MaulikSodha OP

Created 2d

Replies 1

Boosts 0

Participants 2

Hello Apple Team

We are integrating App Attest with our backend and seeing a 400 Bad Request response when calling the attestation endpoint. The issue is that the response does not include an X-Request-ID or JSON error payload with id and code, which makes it hard to diagnose. Instead, it only returns a receipt blob.

Request Details URL: https://data-development.appattest.apple.com/v1/attestationData Request Headers: Authorization: eyJraWQiOiI0RjVLSzRGV1JaIiwidHlwIjoiSldUIiwiYWxnIjoiRVMyNTYifQ.eyJpc3MiOiJOOVNVR1pNNjdRIiwiZXhwIjoxNzU3MDUxNTYwLCJpYXQiOjE3NTcwNDc5NjB9.MEQCIF236MqPCl6Vexg7RcPUMK8XQeACXogldnpuiNnGQnzgAiBQqASdbJ64g58xfWGpbzY3iohvxBSO5U5ZE3l87JjfmQ Content-Type: application/octet-stream Request Body: (Binary data, logged as [B@59fd7d35) Response

Status: 400 Bad Request Response Headers: Date: Fri, 05 Sep 2025 04:52:40 GMT x-b3-traceid: 4c42e18094022424 x-b3-spanid: 4c42e18094022424

Response Body (truncated):

"receipt": h'308006092A864886F70D01070... Problem

The response does not include X-Request-ID.

The response does not include JSON with id or code.

Only a receipt blob is returned.

Questions

Can the x-b3-traceid be used by Apple to trace this failed request internally?

Is it expected for some failures to return only a receipt blob without X-Request-ID?

How should we interpret this error so we can handle it properly in production?

Thanks in advance for your guidance.

Boost

Answer 1

endecotp OP

1d

I have this note in my implementation:

  req->SetContentLength(std::to_string(receipt.size()));      // Apple return 400 Bad Request if we don't send this,
                                                              // and it's not added automatically.

0