iOS Rocket Certificate Enabled Entitlements

Each Entitlement below is active in iOS Rocket Certificates , meaning the sideloaded apps has been granted these capabilities/permissions.

App Identity & Debugging : App ID - Team Identifier - Get-task-allow 

Data Sharing (AppGroups& KeyChain ) : App Groups - KeyChain Access Groups

iCloud Services : iCloud Services - iCloud CloudKit Containers ID's -development Cloudkit Containers - iCloud Key Value Store -iCloud document ubiquity containers

Notifications : Push notifications -Communication notifications - Time-sensitive notifications 

Networking & Connectivity : Access Wifi - Hotspot configuration - Multipath - Network extensions - Personal VPN 

Audio & Siri : Push-to-talk - Inter-App Audio - Siri Integration 

Hardware/ Device Integration : Homekit - NFC Tag Reading - Wireless Accesory Configuration

Healthkit & Wellness : Healthkit - Health Records Access - Healthkit Background Delivery

Apple Services & Features : Apple Pay (Merchant  ID) - Wallet Passes (Passkit) - Game Center - ClassKit - WeatherKit 

System Resource Access : Extended Virtual Addressing - Increased Memory Limit - Increased Debugging Memory 

 

Further Explanation of Entitlements : 

 

App Identity & Debugging :

•The unique App ID string for the application, combining the Team ID and the app’s bundle identifier. This identifies the app in code signing and must match the provisioning profile’s App ID .

•The Team Identifier for the Apple Developer account. It indicates which development team (Apple Developer Team ID) signed the sideloaded app, linking the app to the correct team/provisioning profile (used in entitlements like iCloud and App Groups).

•The get-task-allow – Allows the sideloaded app to be debugged, Other processes (like a debugger) can attach to the app’s process . (This is enabled so you can run and debug the app )

Data Sharing (App Groups & Keychain) : 

•The App Groups entitlement enables the sideloaded app to access shared group containers and perform inter-process data sharing between related apps . (This allows multiple apps from the same team to share files or UserDefaults if they belong to the same app group.)

•The Keychain Access Groups entitlement allows the sideloaded app to share keychain items with other apps from the same development team . All apps in the same keychain group can access the group’s stored credentials.

iCloud & Cloud Services :

•The iCloud services  (All iCloud services are enabled) .

•The iCloud CloudKit container IDs  allows the sideloaded app to use specific CloudKit containers (identified by iCloud container identifiers) for storing and fetching data .

•The development CloudKit containers  would list container IDs used when running in development mode .

•The iCloud Key-Value Store (ubiquitous key-value storage). This identifies the app’s iCloud K/V store container, typically formatted as <TeamID>.<BundleID> . It allows the sideloaded app to save small data (preferences, etc.) in iCloud so that it syncs across the user’s devices.

•The iCloud document ubiquity containers the sideloaded app can use for iCloud Drive or document storage, the presence of this key indicates iCloud document storage could be used if configured.

Notifications :

•The Push Notifications entitlement. Specifies which Apple Push Notification service (APNs) environment the app is allowed to use . For example, a value of development or production indicates the app can receive push notifications in the respective APNs environment (the profile shows production, meaning push notifications for the production environment are enabled).

•The Communication Notifications entitlement allows the sideloaded app to send notifications classified as communication between users (person-to-person messages or calls) . This lets the system know the notifications involve direct communication (such as a chat or VOIP call), which may be given higher priority in notification summary and Focus modes.

•The Time-Sensitive Notifications entitlement allows the sideloaded app to send time-sensitive alerts . These notifications denote urgent information that should alert the user immediately and are allowed to break through modes like Do Not Disturb or Focus (they will be delivered prominently as they require timely attention).

Networking & Connectivity :

•The Access Wi-Fi Information entitlement allows the sideloaded app to obtain information about the currently connected Wi-Fi network  (such as the Wi-Fi SSID/BSSID). Apps without this entitlement will get limited or no Wi-Fi info for privacy reasons.

•The Hotspot Configuration entitlement enables the sideloaded app to configure or join Wi-Fi networks without user interaction . With this, the app can programmatically connect to Wi-Fi networks or configure hotspot settings (useful for apps that manage Wi-Fi or hotspot connectivity).

•The Multipath entitlement allows the sideloaded app to use multipath protocols (such as Multipath TCP) . This means the app can leverage multiple network interfaces simultaneously or seamlessly switch between Wi-Fi and cellular data for a more robust network connection (useful for VPNs or streaming where connectivity is critical).

•The Network Extensions entitlement allows the sideloaded app to create certain network-related app extensions that extend system networking capabilities . Depending on the array values, this can permit VPN tunnel providers, content filters, packet tunnel providers, DNS proxies/settings, etc. 

•The Personal VPN entitlement allows the sideloaded app to use the Personal VPN API , meaning it can establish and manage VPN connections. The presence of this entilement indicates the app is permitted to create VPN configurations programmatically as a personal VPN client.

Audio & Siri :

•The Push-to-Talk entitlement enables the sideloaded app to participate in Push-to-Talk audio sessions (walkie-talkie style communication). With this entitlement, the app can report PTT channels to the system and handle transmitting/receiving audio in the background  (e.g., for apps that provide two-way radio communication features).

•The Inter-App Audio entitlement allows the sideloaded app to send audio to, and receive audio from, other apps on the device that also support Inter-App Audio . This was used by music and audio apps to stream audio between apps (for example, connecting a guitar effects app to a recording app). Note: This entitlement is deprecated as of iOS 13 .

•The Siri Integration entitlement allows the sideloaded app to integrate with Siri through SiriKit . Apps with this entitlement can handle Siri requests/intents (for example, sending messages, booking rides, or other SiriKit domain interactions related to the app).

Hardware/Device Integration :

•The HomeKit entitlement enables the sideloaded app to interact with HomeKit accessories and home automation devices . With this, the app can control smart-home devices (lights, locks, thermostats, etc.) and integrate with the user’s Home app setup.

•The NFC Tag Reading entitlement allows the sideloaded app to use Core NFC to read NFC tags of specified types . In the profile, the array ['NDEF', 'TAG', 'PACE'] indicates the app can read standard NDEF tags, generic NFC tags, and PACE tags (used in electronic passports), enabling NFC scanning functionality.

•The Wireless Accessory Configuration entitlement allows the sideloaded app to wirelessly configure or communicate with external accessories . Apps with this entitlement can set up Wi-Fi/Bluetooth accessories (typically Made for iPhone/Apple-certified accessories) by sending configuration data to them.

HealthKit & Wellness :

•The HealthKit entitlement grants the sideloaded app permission to access HealthKit data (such as workouts, nutrition, vital signs) with the user’s consent . This is required for any app that reads or writes health data to the Apple Health app database.

•The Health Records Access entitlement allows the sideloaded app to access certain sensitive health data types that require special approval, such as Health Records (clinical health records from hospitals) via HealthKit. The app specifies which data type it needs (here the array contains "health-records"). Only apps with this entitlement (granted by Apple) can read those restricted health record types.

•The HealthKit Background Delivery entitlement. A Boolean that permits the sideloaded app to receive HealthKit updates while running in the background . With this enabled , the app’s HealthKit observer queries can continue to get data updates even when the app is not in the foreground (useful for monitoring health data that changes frequently, like heart rate, in near-real-time).

Apple Services & Features :

•The Apple Pay (Merchant ID) entitlement allows the sideloaded app to use Apple Pay to accept payments within the app for physical goods or services .

•The Wallet Passes (PassKit) entitlement typically includes the Pass Type IDs the app can use. 

•The Game Center entitlement Indicates the sideloaded app can integrate with Game Center, Apple’s social gaming network. When true, the app is allowed to use Game Center features such as leaderboards, achievements, and multiplayer matchmaking. 

•The ClassKit entitlement. Specifies the environment for Apple’s ClassKit framework (used with the Schoolwork app). This enables an education app to share student progress with teachers privately and securely . The value can be "development" or "production" – with us it is set to production, meaning the app is configured to work with the Schoolwork app in a real classroom environment (not just in development testing).

•The WeatherKit entitlement allows the app to use WeatherKit to retrieve weather data from Apple’s weather service . With this entitlement , the app can request current weather, forecasts, and other climate data via Apple’s WeatherKit APIs.

System Resource Access :

•The Extended Virtual Addressing entitlement allows the app to use a larger virtual address space , i.e., allocate more memory than a typical app. This is usually granted to apps that need to handle very large data sets or memory-intensive operations on supported devices.

•The Increased Memory Limit entitlement enables the sideloaded app to exceed the normal app memory limits on devices . Apps with this entitlement can use more RAM than standard apps before the system terminates them for memory usage, which is useful for high-performance or resource-intensive applications.

•The Increased Debugging Memory entitlement. Similar to the above, but specifically allows the sideloaded app to use more memory while being debugged. This helps prevent the app from being killed for memory during debugging sessions. (It is typically used during development to facilitate testing large-memory scenarios with a debugger attached.)

 

This structured list should help clarify what permissions or features each entitlement key allows. Each key corresponds to an enabled capability or integration that the sideloaded app can utilize.