adattributionkit

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: instruction override, no behavioural pass.

With Developer Mode enabled, configure an HTTP proxy on the device (Settings >

Audit 0.4.1 · source sha 8c7069c512a0 · 22 Oct 2026Report an issue or request a re-scan

• Publisherdpearson2699 GitHub userOwner of the repository this skill is read from
• Source folderdpearson2699/swift-ios-skills/skills/adattributionkitThe exact folder we audited
• LicenceNOASSERTIONAs the repository states it
• Commit pinned for this verdict8c7069c512a0A new audit runs when the source changes
• Repository statusNot archivedLast push 82 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Measure ad effectiveness with privacy-preserving attribution using AdAttributionKit. Use when registering ad impressions, handling attribution postbacks, updating conversion values, implementing re-engagement…

---
name: adattributionkit
description: "Measure ad effectiveness with privacy-preserving attribution using AdAttributionKit. Use when registering ad impressions, handling attribution postbacks, updating conversion values, implementing re-engagement attribution, configuring publisher or advertiser apps, or replacing SKAdNetwork with AdAttributionKit for ad measurement."
---

# AdAttributionKit

Privacy-preserving ad attribution for iOS 17.4+. AdAttributionKit
lets ad networks measure conversions (installs and re-engagements) without
exposing user-level data. It supports the App Store and alternative
marketplaces, and interoperates with SKAdNetwork.

Three roles exist in the attribution flow: the **ad network** (signs
impressions, receives postbacks), the **publisher app** (displays ads), and the
**advertised app** (the app being promoted).

## Contents

- [Overview and Privacy Model](#overview-and-privacy-model)
- [Publisher App Setup](#publisher-app-setup)
- [Advertiser App Setup](#advertiser-app-setup)
- [Impressions](#impressions)
- [Postbacks](#postbacks)
- [Conversion Values](#conversion-values)
- [Re-engagement](#re-engagement)
- [Common Mistakes](#common-mistakes)
- [Review Checklist](#review-checklist)
- [References](#references)

## Overview and Privacy Model

AdAttributionKit preserves user privacy through several mechanisms:

- **Crowd anonymity tiers** -- the device limits postback data granularity based
  on the crowd size associated with the ad, ranging from Tier 0 (minimal data)
  to Tier 3 (most data including publisher ID and country code).
- **Time-delayed postbacks** -- postbacks are sent 24-48 hours after conversion
  window close (first window) or 24-144 hours (second/third windows).
- **No user-level identifiers** -- postbacks contain aggregate source
  identifiers and conversion values, not device or user IDs.
- **Hierarchical source identifiers** -- 2, 3, or 4-digit source IDs where the
  number of digits returned depends on the crowd anonymity tier.

In migration and interoperability reviews, explicitly state that the system
evaluates AdAttributionKit and SKAdNetwork impressions together, only one
impression wins per conversion, click-through beats view-through, and recency
breaks ties within click-through impressions before falling back to the most
recent view-through impression.

## Publisher App Setup

A publisher app displays ads from registered ad networks. Add each ad network's
ID to the app's Info.plist so its impressions qualify for install validation.

### Add ad network identifiers

```xml
<key>AdNetworkIdentifiers</key>
<array>
    <string>example123.adattributionkit</string>
    <string>another456.adattributionkit</string>
</array>
```

Ad network IDs must be lowercase. SKAdNetwork IDs (ending in `.skadnetwork`)
are also accepted -- the frameworks share IDs.

### Display a UIEventAttributionView

For click-through custom-rendered ads, place one `UIEventAttributionView` over
each tappable ad/control. It must cover the tappable area and stay above views
that would intercept touches before `handleTap()` succeeds.

```swift
import UIKit

let attributionView = UIEventAttributionView()
attributionView.frame = adContentView.bounds
attributionView.isUserInteractionEnabled = true
adContentView.addSubview(attributionView)
```

## Advertiser App Setup

The advertised app is the app someone installs or re-engages with after seeing
an ad. It must call a conversion value update at least once to begin the
postback conversion window.

### Opt in to receive winning postback copies

Add `AttributionCopyEndpoint` under the top-level `AdAttributionKit` Info.plist
dictionary so the device sends a copy of the winning postback to your server:

```xml
<key>AdAttributionKit</key>
<dict>
    <key>AttributionCopyEndpoint</key>
    <string>https://example.com</string>
</dict>
```

The system derives the well-known endpoint from the registrable domain in the
URL, ignoring subdomains:

```
https://example.com/.well-known/appattribution/report-attribution/
```

Configure your server to accept HTTPS POST requests at that path. The domain
must have a valid SSL certificate.

### Opt in for re-engagement postback copies

Add a second key in the same `AdAttributionKit` dictionary to also receive
copies of winning re-engagement postbacks:

```xml
<key>AdAttributionKit</key>
<dict>
    <key>AttributionCopyEndpoint</key>
    <string>https://example.com</string>
    <key>OptInForReengagementPostbackCopies</key>
    <true/>
</dict>
```

### Update conversion value on first launch

Call a conversion value update as early as possible after first launch to begin
the conversion window:

```swift
import AdAttributionKit

func applicationDidFinishLaunching() async {
    do {
        try await Postback.updateConversionValue(0, lockPostback: false)
    } catch {
        print("Failed to set initial conversion value: \(error)")
    }
}
```

## Impressions

Ad networks create signed impressions using JWS (JSON Web Signature). The
publisher app uses `AppImpression` to register and handle those impressions.

### Create an impression from a JWS

```swift
import AdAttributionKit

let impression = try await AppImpression(compactJWS: signedJWSString)
```

The JWS contains the ad network ID, advertised item ID, publisher item ID,
source identifier, timestamp, and optional re-engagement eligibility flag. See
[references/adattributionkit-patterns.md](references/adattributionkit-patterns.md)
for JWS generation details.

### Check device support

```swift
guard AppImpression.isSupported else {
    // Fall back to alternative ad display
    return
}
```

### View-through impressions

Record a view impression when the ad content has been displayed and dismissed:

```swift
func handleAdViewed(impression: AppImpression) async {
    do {
        try await impression.handleView()
    } catch {
        print("Failed to record view-through impression: \(error)")
    }
}
```

For long-lived ad views, use `beginView()` an

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/dpearson2699/swift-ios-skills
git -C swift-ios-skills checkout 8c7069c512a0

Works in

1. 2026-10-22
   !CAUTION C 79 / 100

   first audit · source 8c7069c512a0

Questions about adattributionkit

• github.com/dpearson2699/swift-ios-skills/tree/main/skills/adattr — the audited source at commit 8c7069c512a0 and every finding aboveObserved · 22 Oct 2026

Spotted something wrong? Report a correction · Methodology