OpenNHP/opennhp · error

Error: fail to find policyId for ztdoId

Error message

Error: fail to find policyId for ztdoId %s.

What it means

Before calling the trusted application the agent looks up the ztdoId in its smartPolicyIdentifier map; if no policyId is registered for that data object it returns this error. The policyId is required to route the confidential-computing request, so a missing mapping is fatal for the call.

Solutions

1. Fix any upstream 'Failed to refresh SDP' error so RefreshDataAccess populates smartPolicyIdentifier
2. Verify the exact ztdoId string matches what the policy/data provider issued (trim whitespace/case)
3. Re-run PreCheckDataAccess / re-fetch the smart data policy before invoking the trusted application

Example fix

// before
taRes, err := a.CallTrustedApplication(taId, function, params, "")
// after
policyId, ok := a.smartPolicyIdentifier[ztdoId]
if !ok {
    if _, err := a.RefreshDataAccess(ztdoId, decrypted, output); err != nil { return nil, err }
    policyId = a.smartPolicyIdentifier[ztdoId]
}
taRes, err := a.CallTrustedApplication(taId, function, params, policyId)

policyId, ok := a.smartPolicyIdentifier[ztdoId]
if !ok {
    return fmt.Errorf("no policy for %s; refresh SDP first", ztdoId)
}

res, err := a.AccessData(ztdoId, taId, fn, params)
if err != nil && strings.Contains(err.Error(), "fail to find policyId") {
    // trigger SDP refresh path and retry
    res, err = a.AccessData(ztdoId, taId, fn, params)
}

When it happens

Trigger: AccessData/TA call path where a.smartPolicyIdentifier[ztdoId] is absent — SDP never fetched, refresh skipped, or map populated under a different ztdoId.

Common situations: Querying a ztdo before its smart data policy was downloaded; ztdoId case/whitespace mismatch; agent restarted and in-memory policy map lost; earlier SDP refresh failure (error 34) left the map empty.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• Failed to refresh SDP
• fail to call trusted application with error
• fail to unmarshal confidential computing result
• Error: fail to generating temporary file path
• failed to unmarshal data private key wrapping

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/a373fca10224d6e0. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/agent/udpagent.go:1286

		defer a.dataAccessRefreshMutex.Unlock()

		// secondly check again
		output, refreshSdp, decrypted = a.PreCheckDataAccess(ztdoId)

		if refreshSdp {
			output, err = a.RefreshDataAccess(ztdoId, decrypted, output)
			if err != nil {
				return nil, fmt.Errorf("Failed to refresh SDP: %s", err.Error())
			}
		}
	}

	// inject data path to params
	params["path"] = output

	var exist bool
	if policyId, exist = a.smartPolicyIdentifier[ztdoId]; !exist {
		return nil, fmt.Errorf("Error: fail to find policyId for ztdoId %s.\n", ztdoId)
	}

	taRes, err := a.CallTrustedApplication(taId, function, params, policyId)
	if err != nil {
		return nil, fmt.Errorf("fail to call trusted application with error: %s\n", err.Error())
	} else {
		var structResult map[string]any

		err := json.Unmarshal([]byte(taRes), &structResult)
		if err != nil {
			return nil, fmt.Errorf("fail to unmarshal confidential computing result: %s\n", err.Error())
		}

		return structResult, nil
	}
}

func (a *UdpAgent) PreCheckDataAccess(ztdoId string) (output string, refreshSdp bool, decrypted bool) {

View on GitHub (pinned to 6e04ca5ff0)