Clarification needed on rejection feedback — tool annotations and developer name mismatch

Hi all,

We received a rejection on our Apps submission with two cited issues, and would appreciate any input to help us sanity-check our interpretation before resubmitting.

Relevant portion of the rejection:

One or more of your tool’s annotations do not appear to match the tool’s behavior. Please confirm annotations are explicitly set to true or false (not null) for every tool. Include a clear justification for why the hint is set that way based on the tool’s actual behavior.

The developer name you entered does not match your verified individual or business name. Please update the developer name so it matches the verified name on your account. If you would like to publish under a business name but not have yet …

Two questions and one sanity check:

1. “Explicitly set to true or false (not null) for every tool” — does this include idempotentHint?

The Apps SDK reference ( Reference – Apps SDK | OpenAI Developers ) lists readOnlyHint, destructiveHint, and openWorldHint as Required, and idempotentHint as Optional. In practice, do reviewers treat idempotentHint as also required to avoid a null-annotation flag?

1. Sanity check on what we think is the actual mismatch.

We believe the flagged tool is one that generates a session on our backend (POSTs to create, then accepts further actions against that session. Cleared regularly). It was declared readOnlyHint: true, which doesn’t match the write behavior. Our planned correction:

readOnlyHint: false        (creates state via POST; not side-effect-free; not safe to retry)
destructiveHint: false     (no delete/overwrite; each submission adds a new record)
openWorldHint: false       (all writes stay within our first-party backend)

Does that combination read as correct for a first-party write tool, or would reviewers want destructiveHint or openWorldHint set differently?

Rest of our tools are all fetch-and-display type, and all tools are non-OAuth.

1. Developer name mismatch when both individual AND business verification are complete.

We’ve completed both individual and business verifications on the account. Has anyone hit this with both on file?

‘Organization name’ was entered in as the ‘Developer’ in the second image.

Lastly, not fully related to the subject, but we submitted our app around December, and received the rejection on last Friday evening. How long did the appeal/resubmission feedback usually take? Hoping it wouldn’t take that long again.

Thanks in advance!