iOS SDK Integration Guide

Repository

github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2

Read Platform parity vs. Android before assuming any control here behaves identically to the Android SDK. Several genuinely don’t, for platform reasons, not implementation gaps.

Requirements

iOS 14.0+ (App Attest requires 14+)
Xcode 15+
This repo is private — you’ll need GitHub access (SSH key or PAT) to add it as a Swift Package dependency

Install

Add the package in Xcode

File → Add Package Dependencies → paste:

https://github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2

Or add it to Package.swift directly

dependencies: [
    .package(url: "https://github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2", from: "1.0.0")
]

Initialize

import InsightAIRasp

InsightAiSdk.shared.initialize(config: InsightAiConfig(
    tenantId: "your_tenant_id",
    ingestUrl: URL(string: "https://ingest.insightsecure.ai/v1/rasp/ingest")!,
    hmacSecretKey: "your_hmac_secret", // from your tenant credentials — see Authentication
    expectedSignatureHashes: [] // see Platform parity — iOS doesn't compare hashes the way Android does
))

Gate a sensitive action

let evaluation = InsightAiSdk.shared.evaluate()
switch evaluation.raspAction {
case "BLOCK": showBlockedScreen()
case "REVIEW": proceedWithStepUpAuth()
default: proceedNormally()
}

MITM detection

The SDK ships a ready URLSessionDelegate that pins and reports automatically:

let config = SslPinningConfig(
    hostname: "api.yourapp.com",
    pinnedSha256Fingerprints: ["<your public key SHA-256>"] // max 3, per NPCI2025-26IS003
)
let session = URLSession(configuration: .default, delegate: PinnedSessionDelegate(config: config), delegateQueue: nil)

Pin mismatches are reported to the scorer automatically — no separate wiring needed, unlike Android where you catch the exception yourself. 2+ mismatches in a session sets MITM_SUSPECTED and hard-blocks.

Device binding (App Attest)

let attestation = try await AppAttestBridge.shared.attest(
    requestData: "\(transactionId):\(amount):\(timestamp)".data(using: .utf8)!
)
// Send `attestation` to your backend for verification against Apple's servers

Same rule as Android’s Play Integrity: verification must happen server-side. The SDK cannot verify its own attestation locally in any way that would mean anything.

SIM binding

Not bundled — and on iOS specifically, closer to unavoidable rather than just a cost tradeoff:

SimBindingConfig.provider = YourChosenProvider(apiKey: yourApiKey)
let swapDetected = try await SimBindingConfig.provider?.checkSimSwap(phoneNumber: user.phoneNumber)

Apple deprecated CTCarrier’s carrier-info APIs in iOS 16 with no first-party replacement — a third-party provider (tru.ID, Twilio Verify) isn’t just the recommended path here, it’s close to the only one.

OTP-less authentication

if let response = OtpLessAuthManager.respondToChallenge(challengeNonce: nonce, deviceId: deviceId) {
    // Send response.signature to your backend for verification
} else {
    // No binding key yet — fall back to OTP for this session
}

Platform parity vs. Android

Control	Android	iOS
Tamper detection	Cryptographic signature-hash comparison, hard-blocks on mismatch	App Store receipt + provisioning profile heuristic — known TestFlight false positive, never hard-blocks alone
Overlay / tapjacking	Real detection via `FLAG_WINDOW_IS_OBSCURED`	Not implemented — no equivalent cross-app overlay threat surface exists on iOS
Accessibility abuse	Real detection via `AccessibilityManager`	Not implemented — no pluggable AccessibilityService model on iOS
SIM binding	Third-party provider (buy)	Third-party provider (buy) — and realistically the only option, since `CTCarrier` is deprecated
Device binding	Keystore (TEE/StrongBox) + Play Integrity	Secure Enclave + App Attest — equivalent hardware guarantee
MITM detection	Catch the exception yourself, call `reportSslPinMismatch()`	Automatic via `PinnedSessionDelegate`

The absent rows aren’t gaps to “catch up on” later — they reflect real differences in what each platform’s sandboxing model exposes to a third-party app at all.

Testing each control

Control	How to test
Jailbreak detection	Jailbroken physical device (checkra1n/palera1n) — the Simulator cannot be jailbroken, this will always read `false` there
Debugger/Frida	Push `frida-server` to a jailbroken device via SSH, attach with `frida -U -f <bundle-id>`
MITM	Route traffic through Burp Suite/mitmproxy with its CA trusted — the pinned connection should fail before reaching the proxy
Secure Enclave binding	Test on a real device only — Simulator has no SEP chip, `isHardwareBacked` will always read `false` there by design, not a bug

Get Started

Device Intelligence

AML Case Investigation

Repository

Requirements

Install

Initialize

Gate a sensitive action

MITM detection

Device binding (App Attest)

SIM binding

OTP-less authentication

Platform parity vs. Android

Testing each control

Next steps

Android SDK integration guide

Webhook payload reference

Repository

​Requirements

​Install

​Initialize

​Gate a sensitive action

​MITM detection

​Device binding (App Attest)

​SIM binding

​OTP-less authentication

​Platform parity vs. Android

​Testing each control

​Next steps

Android SDK integration guide

Webhook payload reference

Requirements

Install

Initialize

Gate a sensitive action

MITM detection

Device binding (App Attest)

SIM binding

OTP-less authentication

Platform parity vs. Android

Testing each control

Next steps