Hello, Thank you for the hints — they were spot on. The trailing URL problem was indeed our issue: adding a trailing slash to our pirServerURL and pirPrivacyPassIssuerURL resolved the configurationInvalid error entirely. saveToPreferences() now works correctly for both enable and disable. We're now at a point where the URL filter is active (Enabled = YES confirmed in system prefs), but /queries are never reaching our PIR server. Looking at the configuration iOS applies: pirSkipRegistration = NO pirPrivacyProxyFailOpen = NO Our understanding is that with pirSkipRegistration = NO, iOS enforces Privacy Pass authentication via Apple's OHTTP relay before sending any PIR queries — and that relay will only forward requests to servers that have been registered/approved by Apple. Could you confirm this is correct? If so, what is the process to register our PIR server (https://dropbet-pir.fly.dev/) with Apple's OHTTP relay for use with NEURLFilterManager? Is there a form or a specific request channel for this? Thanks again.

Thank you for your previous guidance — I followed your advice and implemented NEURLFilterManager with the url-filter-provider entitlement (added via Signing & Capabilities → Network Extensions → URL Filter). My PIR server and Privacy Pass issuer are running at https://dropbet-pir.fly.dev, and the /.well-known/private-token-issuer-directory endpoint returns HTTP 200 with a valid response. However, when calling NEURLFilterManager.saveToPreferences() on a development build on my own device (iOS 26.5), I receive: NEURLFilterManager.Error code 1 — configurationInvalid Is this expected for a development build without the OHTTP relay, or does the entitlement require an additional approval step even for development testing? Best regards,

Thank you for your response. Two follow-up questions: The url-filter-provider capability does not appear in the Capability Requests tab of my developer portal. Could you advise how to request it for com.dropbet.DropBet (App Store ID: 6762567708)? Regarding the OHTTP relay onboarding form (developer.apple.com/contact/request/network-extension-url-filter): does the full PIR server + Privacy Pass infrastructure need to be deployed and running before submitting the form, or can the request be submitted earlier in the process? Best regards