Guideline 2.5.1 rejection: Software Requirements — public APIs only
How the rejection usually reads: "Your app uses or references the following non-public or deprecated APIs" (ITMS-90338) / "The app references UIWebView" (ITMS-90809)
Why it happens
This one is decided by Apple's automated scan at upload time, before a human sees the build. Private selectors (LSApplicationWorkspace, MobileGestalt, IOKit queries), the long-deprecated UIWebView, and disabled App Transport Security without justification all trip it. The symbol almost always comes from a dependency rather than your own code, so the fix is finding which pod or package contains the string and updating or replacing it.
What can be checked before you submit
5 of RejectProof’s checks map to Guideline 2.5.1. Each one reads your .ipa — no upload — and reports the evidence with a fix.
- Entitlement granted but capability never used
PB-27 · guideline 2.5.1 / 5.1.1 · warning
Turn off capabilities you do not use in Signing & Capabilities (Xcode) or in app.json → expo.ios.entitlements, then regenerate the provisioning profile. Unused HealthKit / HomeKit / Siri / NFC entitlements draw reviewer questions and can trigger a 5.1.1 request for justification.
- App Transport Security disabled for all connections
PB-29 · guideline 2.5.1 / App Transport Security · warning
Remove NSAllowsArbitraryLoads = true from NSAppTransportSecurity, or replace it with NSExceptionDomains for the specific hosts that truly need HTTP. Reviewers ask for a justification when ATS is globally disabled and reject when there is none. Expo: expo.ios.infoPlist.NSAppTransportSecurity.
- Non-public API reference (ITMS-90338)
PB-37 · guideline 2.5.1 · likely rejection
Find which dependency pulls the symbol in (grep your Pods/ node_modules/ for the name in the evidence) and update or replace it. Apple's upload check rejects the binary before a human reviewer sees it, so this blocks submission entirely. Common culprits: old analytics/ad SDKs querying IOKit or MobileGestalt, and 'device info' libraries enumerating installed apps.
- UIWebView still referenced (ITMS-90809)
PB-38 · guideline 2.5.1 · likely rejection
Apple no longer accepts apps that reference UIWebView. Replace it with WKWebView; if the reference comes from a dependency (old React Native < 0.60, Cordova, an ad SDK), upgrade that dependency. Search your Pods and node_modules for 'UIWebView' to find the source.
- External accessory (MFi) protocols declared but no accessory code
PB-41 · guideline 2.5.1 / MFi · warning
UISupportedExternalAccessoryProtocols tells App Review the app talks to MFi hardware, and reviewers ask for the accessory or an MFi PPID. If you removed the hardware integration (or it lives in a library you no longer call), delete the key from Info.plist — Expo: app.json → expo.ios.infoPlist; Xcode: Info.plist — and drop the ExternalAccessory framework so the reference is gone from the binary.
What a scan cannot tell you
Static checks read the build; they do not run it. Whether a reviewer likes your design, agrees with your content, or considers the app “sufficiently different” is their call. Fix the mechanical layer first so the human review is about your product, not about a missing plist key.