PTKDMobile App Security
Knowledge base / PTKD-IOS-REQUIRED-REASON-UNDECLARED
medium M6 MASVS-PRIVACY-2 static analysis PTKD-IOS-REQUIRED-REASON-UNDECLARED

Required-reason API used without a declared reason

The binary appears to use an Apple 'required-reason' API but the privacy manifest does not declare that API category. Apple requires an approved reason code for each such API.

How it's exploited

The binary references an Apple required-reason API (file timestamps, system boot time, disk space, NSUserDefaults) but the privacy manifest does not declare that category with an approved reason. Apple's automated review flags exactly this mismatch on upload.

Why it matters

App Store rejection, and a signal that the app touches fingerprinting-capable APIs without a stated justification.

How to fix it

  1. Add the flagged API category under NSPrivacyAccessedAPITypes in PrivacyInfo.xcprivacy.
  2. Set an approved NSPrivacyAccessedAPITypeReasons value for it; remove the API call if the reason does not apply.

References