Required Reason API used without an approved reason code
Some ordinary APIs can be used to fingerprint a device, so Apple requires you to declare why you use them. The declaration goes in your privacy manifest, and it has to name a reason code Apple actually lists for that category. A missing declaration, an empty reason array, or a code that belongs to a different category all fail.
Why it matters
The categories are file timestamps, system boot time, available disk space, the active keyboard list, and user defaults. Each has its own set of approved reason codes, and the codes are not interchangeable between categories.
A declaration with an empty NSPrivacyAccessedAPITypeReasons array is invalid. It names the category and then says nothing about why, which is the part the requirement is actually about.
The usage is often not yours. A dependency reading UserDefaults or a file creation date puts you in scope even when your own code never touches those APIs, which is why the check looks at the whole project rather than just your sources.
These symbols are also what static analysis tools look for, so an undeclared use is visible from outside your app as well as inside it.
How to fix it
- Identify which category the flagged usage belongs to. The five are distinct and the reason codes differ for each.
- Add an NSPrivacyAccessedAPITypes entry for that category in PrivacyInfo.xcprivacy.
- Fill NSPrivacyAccessedAPITypeReasons with one of the codes Apple lists for that exact category. Copying a code from another category is a common and silent mistake.
- If the usage comes from a dependency rather than your code, check whether that SDK ships its own manifest. It still has to be reflected in yours if the API is reached through your app target.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
Worth knowing
Symbols are matched with context rather than by name alone. UserDefaults.standard is the API and nothing else, so it counts at high confidence. A word like creationDate is a word before it is an API: it counts only on a line that also names FileManager, FileAttributeKey, resourceValues or a file URL, and never on a property declaration or a coding key. A Codable struct with a creationDate field is a model, not a file-system read.
What ReviewAhead checks
Required Reason API declarations. Detected Required Reason API usage must be declared with an approved reason code.
- Matches symbols associated with each Required Reason API category in your project.
- Whether a matching declaration exists in the privacy manifest.
- Whether the declaration carries any reason code at all.
- Whether each reason code is one Apple lists for that category, and names the approved codes when it is not.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.