Hello Apple Team
We are integrating App Attest with our backend and seeing a 400 Bad Request response when calling the attestation endpoint. The issue is that the response does not include an X-Request-ID or JSON error payload with id and code, which makes it hard to diagnose. Instead, it only returns a receipt blob.
Request Details
URL:
https://data-development.appattest.apple.com/v1/attestationData
Request Headers:
Authorization: eyJraWQiOiI0RjVLSzRGV1JaIiwidHlwIjoiSldUIiwiYWxnIjoiRVMyNTYifQ.eyJpc3MiOiJOOVNVR1pNNjdRIiwiZXhwIjoxNzU3MDUxNTYwLCJpYXQiOjE3NTcwNDc5NjB9.MEQCIF236MqPCl6Vexg7RcPUMK8XQeACXogldnpuiNnGQnzgAiBQqASdbJ64g58xfWGpbzY3iohvxBSO5U5ZE3l87JjfmQ
Content-Type: application/octet-stream
Request Body:
(Binary data, logged as [B@59fd7d35)
Response
Status:
400 Bad Request
Response Headers:
Date: Fri, 05 Sep 2025 04:52:40 GMT
x-b3-traceid: 4c42e18094022424
x-b3-spanid: 4c42e18094022424
Response Body (truncated):
"receipt": h'308006092A864886F70D01070...
Problem
The response does not include X-Request-ID.
The response does not include JSON with id or code.
Only a receipt blob is returned.
Questions
Can the x-b3-traceid be used by Apple to trace this failed request internally?
Is it expected for some failures to return only a receipt blob without X-Request-ID?
How should we interpret this error so we can handle it properly in production?
Thanks in advance for your guidance.
Selecting any option will automatically load the page