ITMS-91053: Missing API declaration, and how to fix it

What the email tells you

The notice names a file and at least one category, such as NSPrivacyAccessedAPICategoryUserDefaults. Both matter. The category tells you which manifest entry is missing, and the file tells you which code made the call. Apple's rule is per bundle: for each executable or dynamic library that uses one of these APIs, the bundle that includes it needs a manifest that reports it.

Step 1: find who made the call

If the file is your app's own executable, the call is in your code or in a library linked statically into it. If it is a framework, that framework's maker owes the declaration. To see what a built binary imports:

nm -u MyApp.app/MyApp | grep -E 'stat$|mach_absolute_time|NSUserDefaults|UserDefaults'

A source search misses statically linked SDKs, which is why the binary is worth reading.

Step 2: declare it in the right manifest

Your own code goes in your app's PrivacyInfo.xcprivacy, and the file must be a member of the app target or it never reaches the bundle. For an SDK, update to a version that ships its own manifest. Apple is explicit that a third-party SDK cannot rely on the app's manifest, or another SDK's, to report its use.

<key>NSPrivacyAccessedAPITypes</key>
<array>
  <dict>
    <key>NSPrivacyAccessedAPIType</key>
    <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
    <key>NSPrivacyAccessedAPITypeReasons</key>
    <array><string>CA92.1</string></array>
  </dict>
</array>

Step 3: pick a code that is true

These summaries are short. Read Apple's full text before choosing, since several codes also limit what you may do with the data, such as sending it off the device.

File timestamps: NSPrivacyAccessedAPICategoryFileTimestamp

APIs: creationDate, modificationDate, fileModificationDate, contentModificationDateKey, creationDateKey, stat, fstat, fstatat, lstat, the getattrlist family.

• C617.1: files inside your app or app group container, or your CloudKit container
• DDA9.1: showing timestamps to the person using the device
• 3B52.1: files the person specifically gave you access to
• 0A2A.1: an SDK wrapping the API for the app

System boot time: NSPrivacyAccessedAPICategorySystemBootTime

APIs: systemUptime, mach_absolute_time().

• 35F9.1: measuring time elapsed between events in the app
• 8FFB.1: calculating absolute timestamps for events in the app
• 3D61.1: an optional bug report the person chooses to send

Disk space: NSPrivacyAccessedAPICategoryDiskSpace

APIs: volumeAvailableCapacityKey and its two variants, volumeTotalCapacityKey, systemFreeSize, systemSize, statfs, statvfs, fstatfs, fstatvfs, the getattrlist family.

• E174.1: checking there is room to write, or that space is low so you can clean up
• 85F4.1: showing disk space to the person
• 7D9E.1: an optional bug report
• B728.1: a health research app warning participants

Active keyboards: NSPrivacyAccessedAPICategoryActiveKeyboards

APIs: activeInputModes.

• 54BD.1: presenting the correct customized interface
• 3EC4.1: a custom keyboard app

User defaults: NSPrivacyAccessedAPICategoryUserDefaults

APIs: UserDefaults (and @AppStorage, which uses it).

• CA92.1: data only this app reads and writes
• 1C8F.1: data shared within your App Group
• C56D.1: an SDK wrapping the API for the app
• AC6B.1: reading managed app configuration set by MDM

ITMS-91061 is a different email

ITMS-91061 is about Apple's list of commonly used SDKs. A manifest is required for any listed SDK in a new app, or in an update that adds one. Signatures are also required where a listed SDK is a binary dependency. The list includes Alamofire, Firebase modules, Kingfisher, Lottie, SDWebImage and about eighty more, in any version, and any SDK that repackages them.

Check before you upload

asc-mcp's release_preflight does this from your coding agent. Pass it your project folder and it reads the manifests, the source and any built app on your machine, and reports each category in use with no valid reason, each listed SDK whose manifest it cannot see, and each permission with no purpose string. It prints paths, lines and setting names, runs nothing from the project, and sends nothing from it anywhere. It also loads the support, privacy and terms links in your App Store Connect record.

It cannot promise a result. It checks what can be checked, says what it could not, and is not a prediction of App Review's decision. What Apple's own tools report on upload is the final word for this email.

See pricing, or ask your agent to run it: the free tier includes five calls at Pro read tools like this one.

Questions

What does ITMS-91053 Missing API declaration mean?

Your upload contains code that calls an API on Apple's required reason list, and no privacy manifest in the app declares why. The email names the file and the API category. Add the category to PrivacyInfo.xcprivacy with one of Apple's reason codes, or update the SDK that makes the call.

Where does the fix go if an SDK causes ITMS-91053?

In the SDK's own privacy manifest. Apple says a third-party SDK cannot rely on the app's manifest, or another SDK's, to report its use. Update to a version that ships one. If the SDK is linked statically into your app, the email names your app's own file, so check your dependencies as well as your code.

What is the difference between ITMS-91053 and ITMS-91061?

ITMS-91053 is a required reason API with no declared reason. ITMS-91061 is a missing privacy manifest for an SDK on Apple's list of commonly used SDKs, and it applies to new apps and to updates that add one of those SDKs.

Which reason code should I use for UserDefaults?

CA92.1 if the data is only read and written by the app itself, 1C8F.1 if it is shared across an App Group. Declare what is true of your use: Apple says declared reasons must accurately reflect it.