Create a sanitized SubmitCheck manifest locally

Keep the raw build on your Mac and prepare the JSON accepted by the web portal.

Written By Enrique Bonansea

Last updated About 2 hours ago

Use the local tools

In the dashboard, choose New check and Open local tools to find the SubmitCheck tooling. Use a trusted build or release appropriate to your environment. If you cannot access the tools or a supported release, contact support before substituting another scanner’s output.

  1. Select the .ipa or .xcarchive you intend to check.

  2. Run the local scan and review any archive or extraction errors.

  3. Inspect the generated sanitized manifest and save its JSON output.

  4. Keep the original build on your Mac.

What belongs in the portal

The New check page accepts SubmitCheck’s sanitized JSON manifest, currently with a maximum size of 2 MB. It does not accept the raw .ipa, .xcarchive, source code, assets, or dSYMs.

Keep credentials separate

The native scanner’s job is artifact inspection. Do not place an Apple API key, password, token, or unrelated private data in the manifest. App Store Connect keys belong only in the authenticated connection setup.

If manifest validation fails, preserve the error, confirm you used the supported SubmitCheck exporter, and regenerate the manifest. Do not remove privacy checks or rename a raw artifact to .json to bypass validation.