Last Process 'make sure the root certificate authority is one of the certificates you stored as an Apple Root Certificate Authority.' Can I just verify it with the SHA-256 thumbprint of the root certificate?

Thank you for your answer. I checked the link source, but when checking the certificate chain, except for the root certificate, I didn't see any direct checking of the root certificate. For the value of the 'performanceRevocationChecking' parameter, should I set the 'true' value if the root certificate of 'trustAnchors' includes 'Apple Inc. Root' and 'Apple Computer, Inc. Root'?

I confirmed that the root certificate is excluded when calling the CertPathValidator.validate method in the ChainVerifier class. So, do I not need to verify the root certificate?

When validating the certificate chain, it was verified that the root certificate was removed. Is it safe not to verify the root certificate?

Thank you for your answer. We manage multiple app information and don't know if the apps have a production release. Even if there is a production release, the token hasn't expired, and very occasionally returns a 401 response for unknown reasons. Is there a way to know if it's an actual 401 error, or a 401 error because there's no production release?

Thank you for your reply. I don't think I can provide information on most of the request parameters, do I still need to call?

Thank you for your answer. Does 'playTime' mean the time you used the app after signing up for the app account? Or does it mean the time you used the app after payment?

Is multiple purchases a case of multiple products being purchased together?