Undocumented APIs are exactly that: you are free to call them, but there isn't any information on how to do so (for iOS, this is often POSIX or Mach functions). Private API is intended to be used by Apple exclusively, and is indicated as such by not being in /System/Library/PrivateFrameworks, or included in a usual framework but not intended to be called–either by prefixing the method name with an underscore or not being included in the class's documentation. Private API is occasionally opened up to third-party developers, but this is usually quite rare.
