Any use of private API, even indirectly through a third-party SDK, is an automatic rejection — Apple's static analysis during review checks binaries for private API symbol references.
Almost always caused unknowingly, by a third-party SDK or ad network library that references a private API internally — the app developer often doesn't know until the rejection arrives.
"Your app uses non-public APIs, which is not permitted on the App Store: [API list]. Please update your app..."
Guideline 2.5.1 requires apps to use only Apple's public, documented APIs. Calling private frameworks or undocumented functions, even indirectly, can lead to automatic rejection because Apple scans binaries for such references. Most developers meet this rule unknowingly through a third-party library that touches a private API.
Private interfaces can change or disappear between operating-system releases, so an app that depends on them can break for users after an update. They can also bypass the protections and permissions that public APIs enforce. By requiring public APIs only, Apple keeps system updates predictable, protects user privacy and can analyse binaries automatically. That automated scanning is why this rule is enforced so consistently compared with rules that rely on human judgement.
The rejection normally lists the symbols or frameworks that were detected.
Yes, every submission is analysed.
The rule applies regardless of language.
Platform rules change often. This page is a plain-language explanation written by AppReviewFix, not official guidance. Check the current App Store Review Guidelines for the exact wording.