Required reason API scanner
Pick your Xcode project folder or paste some code, and this page finds the lines that use Apple's required reason APIs, grouped by category, with the file and line number. It then reads your PrivacyInfo.xcprivacy, shows which categories are used but not declared, and writes the missing NSPrivacyAccessedAPITypes entries with the reason codes you pick. Your code is read in this page and never uploaded.
Drop your Xcode project folder here
Or pick the folder or some files. Swift, Objective-C and C files (.swift .m .mm .c .h) and PrivacyInfo.xcprivacy are read in this page; nothing is uploaded.
Third-party SDKs (from CocoaPods, Swift Package Manager or Carthage) must ship their own privacy manifests. Your app's file does not cover their code.
This is a text search. It can miss a use (a call built at run time, a wrapper in a library) and it can flag a line that is not one. Read each hit before you decide.
API names and reason codes are taken from Apple's documentation, checked on 2026-11-01.
What it does
- •Reads .swift, .m, .mm, .c and .h files from the folder or files you pick, or the code you paste. Pods, .build, DerivedData and Carthage folders are skipped, and so are source files over 1 MB.
- •Looks for each API on Apple's list in its Swift and Objective-C spelling: UserDefaults and NSUserDefaults, .creationDate and NSFileCreationDate, systemUptime, mach_absolute_time(), stat(), statfs(), volumeAvailableCapacityKey, activeInputModes and the rest. The list and the reason codes come from Apple's documentation, checked on 1 November 2026.
- •Ignores comments and the inside of string literals, so a commented-out call or a log message does not count. Code inside Swift string interpolation does count.
- •Shows each hit with its file, line number and the line itself, grouped by Apple's five categories. getattrlist, fgetattrlist and getattrlistat are listed in both file timestamp and disk space, as on Apple's page.
- •Reads every PrivacyInfo.xcprivacy it finds (or the one you paste) and sorts each category into used and declared, used but not declared, or declared but not seen.
- •For each missing category, lists Apple's approved reason codes with Apple's own description. You tick the ones that are true; the page writes the XML entries for you to copy.
What it does not do
- •It does not choose reason codes. Only you know why your code reads the clock or the disk, and Apple's wording decides what each code allows.
- •It does not check third-party SDKs. Each SDK must ship its own privacy manifest in its own bundle.
- •It does not read compiled code. A text search can miss a use (a call made through a library or built at run time) and can flag a line that is not one, such as PHAsset.creationDate in the Photos framework.
- •It cannot see uses hidden behind other APIs. SwiftUI's @AppStorage, for example, stores its values in UserDefaults, which is on Apple's list, but the scan does not flag it. If you use it, declare a User defaults reason.
- •It does not edit your files. You copy the entries into your manifest yourself, or build a whole file in the privacy manifest generator.
- •It does not read binary property lists. Convert one first with plutil -convert xml1.
Questions
- What are required reason APIs?
- They are APIs Apple says could be misused to fingerprint a device: file timestamps, system boot time, disk space, active keyboards and user defaults. Apple says App Store Connect does not accept apps that use them without describing the reason in a privacy manifest, which has applied since 1 May 2024.
- I got ITMS-91053 "Missing API declaration". Will this find the cause?
- It finds the uses in your own source code and the category names to declare. The email names the category Apple found in your binary; if the scan does not show it, the use is probably in a third-party SDK, which then needs an updated version that ships its own manifest.
- Which reason should I pick for UserDefaults?
- CA92.1 when only your app reads and writes its own defaults. 1C8F.1 when you share defaults with your extensions or apps in the same App Group. C56D.1 is only for third-party SDKs that wrap UserDefaults, and AC6B.1 is for MDM managed configuration and feedback keys.
- Why does a hit in a comment not show up?
- Comments and text inside quotes are not code that runs, so they are left out. Code inside Swift string interpolation, such as \(UserDefaults.standard.bool(forKey: "x")), is real code and is reported.
- Is my code uploaded anywhere?
- No. The browser reads the files you pick and the search runs in this page. Nothing is sent to a server, and closing the tab discards it.
- A category is declared but the scan did not see it. Should I remove it?
- Only if you are sure. The use may be in a file you did not pick, another target, or code the text search cannot see. The ITMS-91053 email is about a category that is used but missing from the manifest.