App Store Connect: ITMS-91053: Missing API declaration
Since May 2024 Apple rejects uploads that call certain "required reason" APIs, such as UserDefaults, file timestamps or system boot time, without a privacy manifest saying why. The call is often in a third-party SDK rather than your code, so updating the dependency to a version that ships its own PrivacyInfo.xcprivacy can be the whole fix. The rejection email names the API category, which tells you which reason to declare.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Which bundles already include a privacy manifest?
find ~/Library/Developer/Xcode/Archives -name PrivacyInfo.xcprivacy | tail
# Xcode: Organizer > right-click the archive > Generate Privacy Report
# Update SDKs first: most popular ones now ship their own manifest
pod outdated
# SwiftPM: File > Packages > Update to Latest Package Versions
# Then add File > New > File > App Privacy to the app target.
# Example for UserDefaults read by the app itself:
# NSPrivacyAccessedAPITypes
# NSPrivacyAccessedAPIType NSPrivacyAccessedAPICategoryUserDefaults
# NSPrivacyAccessedAPITypeReasons CA92.1How to diagnose Apple errors
macOS developer errors concentrate around three subsystems: the command line tools (xcrun and the active developer directory), the dynamic linker (dyld, library paths, and code signing), and Gatekeeper / notarisation. Apple Silicon added a fourth axis: architecture mismatches between arm64 and x86_64 binaries, which usually surface as confusing "library not loaded" or "bad CPU type" messages rather than as an explicit architecture error.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Check the active developer directory first with
xcode-select -p. After every macOS or Xcode update this can point at a path that no longer exists, breaking git, compilers and package managers all at once. - For dyld errors, run
otool -L /path/to/binaryto list what it actually wants, then verify each path exists.DYLD_PRINT_LIBRARIES=1shows the resolution order at runtime. - Confirm architecture with
file /path/to/binaryanduname -m. On Apple Silicon, a Rosetta shell reportsx86_64and will silently install the wrong Homebrew prefix. - Homebrew lives at
/opt/homebrewon Apple Silicon and/usr/localon Intel. Permission errors under/usr/localon an M-series Mac almost always mean a Rosetta/native mix-up. - For Gatekeeper and notarisation, use
spctl -a -vvvto assess a bundle andxcrun notarytool logto get the actual rejection reason. The submission status alone tells you nothing useful.
Tools worth reaching for
xcode-select -potool -Lcodesign -dv --verbose=4spctl -a -vvvxcrun notarytool log
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Apple errors
- Homebrew: Cannot install under Rosetta 2 in ARM default prefixThe arm64 Homebrew in /opt/homebrew refuses to run in a translated process, which is what…
- Homebrew: Permission denied @ /usr/localHomebrew cannot write to its prefix because directory ownership is wrong, common on Intel…
- ld: symbol(s) not found for architecture arm64Compilation succeeded and the linker could not find a definition for something that was…
- macOS: "App" is damaged and can’t be opened. You should move it to the BinGatekeeper is reporting a failed signature or notarisation check on a quarantined download…
- macOS: cannot be opened because the developer cannot be verifiedGatekeeper blocked something that carries the quarantine attribute and is not notarised…
- macOS: dyld: Library not loadedThe dynamic linker could not find a shared library at the path baked into the binary, often…
- macOS: errSecAuthFailed / Keychain access deniedA code-signing or credential operation could not read the Keychain, common in CI when the…
- macOS: notarization failed (notarytool)Apple's notary service rejected the app, usually for unsigned/un-hardened binaries, a missing…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.