App Information

Name, category, age rating & privacy.

Source: App Store Connect. This is where the audit begins — the app lookup here is the entry point every other ASC section depends on.

App lookup

ID: app-lookup · Can be: Blocking, Passed

The entry point: GET /apps?filter[bundleId]=<bundle id>. AuditStore looks up your app by bundle id.

• Passed — an app record matched; records its name, bundle id, and id.
• Blocking — nothing matched the bundle id for this API key. Confirm the bundle id and that the key belongs to the same team.

If this request fails for auth/transport reasons (e.g. 401), every ASC-derived category is blocked with the same error rather than left empty.

App Info record

ID: app-info-state · Can be: Blocking, Info, Error

Follows appInfos and reports the App Store state.

• Info — record found; shows count and current App Store state.
• Blocking — no appInfo record exists for the app.

Age rating

ID: age-rating · Can be: Blocking, Passed, Error

Follows ageRatingDeclaration on the app info.

• Passed — an age rating declaration is present.
• Blocking — no declaration (missing or empty, including a 404). App Store Connect requires an age rating before submission.

Privacy Policy URL

ID: privacy-url · Can be: Blocking, Passed, Error

Follows appInfoLocalizations and checks privacyPolicyUrl for every locale.

• Passed — set for all localizations.
• Blocking — missing for one or more locales (which it names). A missing Privacy Policy URL holds the version in “Missing Metadata”.

Primary category

ID: category-primary · Can be: Recommended, Passed, Error

Follows primaryCategory on the app info.

• Passed — a primary category is configured.
• Recommended — no primary category set (including a 404). Required for the listing.

App Privacy (data collection)

ID: privacy-nutrition · Can be: Info

The publish flag isn’t reliably exposed on a stable endpoint, so this is neutral guidance rather than a fabricated pass/fail: verify your data-collection answers are published, not left in draft, and that declared data types match your code.

App Privacy cross-check

ID: privacy-crosscheck · Can be: Recommended, Passed, Info, Error

The E1 cross-check. Compares the privacy-sensitive APIs your code actually references (from local analysis) against the data categories declared in App Privacy (appDataUsages). Only runs when a local project supplied capabilities.

• Passed — every sensitive API your code uses has a matching declared data type.
• Recommended — App Privacy declares no collection (or no matching type) while the code references sensitive APIs. Accessing an API isn’t proof of collection, so this prompts verification rather than asserting a violation — but an inaccurate nutrition label is a frequent rejection.
• Info — usages exist but their categories couldn’t be read to pinpoint a match; verify manually.

NOTE

The App Encryption Declaration check also reads from the app record but is filed under Build & Compliance, where its export-compliance context lives.