> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insightsecure.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# iOS SDK Integration Guide

> Installing and integrating the InsightAI RASP SDK for iOS

<Card title="Repository" icon="github" href="https://github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2">
  github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2
</Card>

<Warning>
  Read [Platform parity vs. Android](#platform-parity-vs-android) before assuming any control here behaves identically to the Android SDK. Several genuinely don't, for platform reasons, not implementation gaps.
</Warning>

## Requirements

* iOS 14.0+ (App Attest requires 14+)
* Xcode 15+
* This repo is private — you'll need GitHub access (SSH key or PAT) to add it as a Swift Package dependency

## Install

<Steps>
  <Step title="Add the package in Xcode">
    File → Add Package Dependencies → paste:

    ```
    https://github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2
    ```
  </Step>

  <Step title="Or add it to Package.swift directly">
    ```swift theme={null}
    dependencies: [
        .package(url: "https://github.com/InsightAI-Pinnacle-Technologies/di-sdk-ios-rasp-v1.0.2", from: "1.0.0")
    ]
    ```
  </Step>
</Steps>

## Initialize

```swift theme={null}
import InsightAIRasp

InsightAiSdk.shared.initialize(config: InsightAiConfig(
    tenantId: "your_tenant_id",
    ingestUrl: URL(string: "https://ingest.insightsecure.ai/v1/rasp/ingest")!,
    hmacSecretKey: "your_hmac_secret", // from your tenant credentials — see Authentication
    expectedSignatureHashes: [] // see Platform parity — iOS doesn't compare hashes the way Android does
))
```

## Gate a sensitive action

```swift theme={null}
let evaluation = InsightAiSdk.shared.evaluate()
switch evaluation.raspAction {
case "BLOCK": showBlockedScreen()
case "REVIEW": proceedWithStepUpAuth()
default: proceedNormally()
}
```

## MITM detection

The SDK ships a ready `URLSessionDelegate` that pins and reports automatically:

```swift theme={null}
let config = SslPinningConfig(
    hostname: "api.yourapp.com",
    pinnedSha256Fingerprints: ["<your public key SHA-256>"] // max 3, per NPCI2025-26IS003
)
let session = URLSession(configuration: .default, delegate: PinnedSessionDelegate(config: config), delegateQueue: nil)
```

Pin mismatches are reported to the scorer automatically — no separate wiring needed, unlike Android where you catch the exception yourself. 2+ mismatches in a session sets `MITM_SUSPECTED` and hard-blocks.

## Device binding (App Attest)

```swift theme={null}
let attestation = try await AppAttestBridge.shared.attest(
    requestData: "\(transactionId):\(amount):\(timestamp)".data(using: .utf8)!
)
// Send `attestation` to your backend for verification against Apple's servers
```

<Warning>
  Same rule as Android's Play Integrity: verification **must** happen server-side. The SDK cannot verify its own attestation locally in any way that would mean anything.
</Warning>

## SIM binding

Not bundled — and on iOS specifically, closer to unavoidable rather than just a cost tradeoff:

```swift theme={null}
SimBindingConfig.provider = YourChosenProvider(apiKey: yourApiKey)
let swapDetected = try await SimBindingConfig.provider?.checkSimSwap(phoneNumber: user.phoneNumber)
```

Apple deprecated `CTCarrier`'s carrier-info APIs in iOS 16 with no first-party replacement — a third-party provider (tru.ID, Twilio Verify) isn't just the recommended path here, it's close to the only one.

## OTP-less authentication

```swift theme={null}
if let response = OtpLessAuthManager.respondToChallenge(challengeNonce: nonce, deviceId: deviceId) {
    // Send response.signature to your backend for verification
} else {
    // No binding key yet — fall back to OTP for this session
}
```

## Platform parity vs. Android

| Control              | Android                                                          | iOS                                                                                                               |
| -------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Tamper detection     | Cryptographic signature-hash comparison, hard-blocks on mismatch | App Store receipt + provisioning profile **heuristic** — known TestFlight false positive, never hard-blocks alone |
| Overlay / tapjacking | Real detection via `FLAG_WINDOW_IS_OBSCURED`                     | **Not implemented** — no equivalent cross-app overlay threat surface exists on iOS                                |
| Accessibility abuse  | Real detection via `AccessibilityManager`                        | **Not implemented** — no pluggable AccessibilityService model on iOS                                              |
| SIM binding          | Third-party provider (buy)                                       | Third-party provider (buy) — and **realistically the only option**, since `CTCarrier` is deprecated               |
| Device binding       | Keystore (TEE/StrongBox) + Play Integrity                        | Secure Enclave + App Attest — equivalent hardware guarantee                                                       |
| MITM detection       | Catch the exception yourself, call `reportSslPinMismatch()`      | Automatic via `PinnedSessionDelegate`                                                                             |

The absent rows aren't gaps to "catch up on" later — they reflect real differences in what each platform's sandboxing model exposes to a third-party app at all.

## Testing each control

| Control                | How to test                                                                                                                    |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Jailbreak detection    | Jailbroken physical device (checkra1n/palera1n) — **the Simulator cannot be jailbroken**, this will always read `false` there  |
| Debugger/Frida         | Push `frida-server` to a jailbroken device via SSH, attach with `frida -U -f <bundle-id>`                                      |
| MITM                   | Route traffic through Burp Suite/mitmproxy with its CA trusted — the pinned connection should fail before reaching the proxy   |
| Secure Enclave binding | Test on a real device only — Simulator has no SEP chip, `isHardwareBacked` will always read `false` there by design, not a bug |

## Next steps

<CardGroup cols={2}>
  <Card title="Android SDK integration guide" icon="android" href="/device-intelligence/android-sdk" />

  <Card title="Webhook payload reference" icon="webhook" href="/api-reference/webhooks-and-payload" />
</CardGroup>