{"record":{"id":"0e7071f75a0b2ee8","repo":"owasp-amass/amass","slug":"s-scope-status-s-error-s","errorCode":null,"errorMessage":"%s/scope: status=%s error=%s","messagePattern":"(.+?)/scope: status=(.+?) error=(.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/api/client/v1/client.go","lineNumber":205,"sourceCode":"\treturn &st, nil\n}\n\n// Retrieves scope for the session associated with the provided token.\nfunc (c *Client) SessionScope(ctx context.Context, token uuid.UUID, atype oam.AssetType) ([]oam.Asset, error) {\n\tsessionID := token.String()\n\tatypestr := strings.ToLower(string(atype))\n\tu := fmt.Sprintf(\"%s/sessions/%s/scope/%s\", c.base, sessionID, atypestr)\n\tresp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{URL: u})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tmsg, err := readJSONError(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"%s/scope: status=%s\", token.String(), resp.Status)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"%s/scope: status=%s error=%s\", token.String(), resp.Status, msg)\n\t}\n\n\treader := strings.NewReader(resp.Body)\n\treadCloser := io.NopCloser(reader)\n\tdefer func() { _ = readCloser.Close() }()\n\n\treturn apiclient.DecodeAssetsForScopeEndpoint(atype, readCloser)\n}\n\n// Creates a new asset on the server associated with the provided token.\nfunc (c *Client) CreateAsset(ctx context.Context, token uuid.UUID, asset oam.Asset) (string, error) {\n\tatype := strings.ToLower(string(asset.AssetType()))\n\traw, err := asset.JSON()\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tsessionID := token.String()","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/api/client/v1/client.go#L187-L223","documentation":"SessionScope's richer variant of the non-200 handling: when the server responds with a non-200 status AND its body parses as a JSON error via readJSONError, the client includes the server-provided message in the error. It reports the session token, HTTP status, and the server's error text for the scope request.","triggerScenarios":"Calling Client.SessionScope when the server explicitly rejects the request — e.g. invalid session token (401), unknown session or asset type (404), or internal failure (500) — and returns a JSON error body.","commonSituations":"Expired or revoked session tokens, requesting a scope for an asset type the session never queried, or server-side validation failures during bulk data collection.","solutions":["Read the error=%s portion: it contains the server's own explanation.","Validate the session token before calling; re-authenticate if it was rejected.","Check that the requested asset type scope exists for this session.","Retry the request if the server reported a transient (5xx) condition."],"exampleFix":"// before\nassets, err := client.SessionScope(ctx, token, atype)\nlog.Println(err) // opaque\n// after\nassets, err := client.SessionScope(ctx, token, atype)\nif err != nil {\n    var he *HTTPStatusError // or strings.Contains check on \"status=401\"\n    if errors.As(err, &he) && he.StatusCode == 401 { token = reauth(ctx) }\n    return err\n}","handlingStrategy":"try-catch","validationCode":"if token == uuid.Nil { return errors.New(\"session token not initialized\") }","typeGuard":"func isAuthFailure(err error) bool { return err != nil && strings.Contains(err.Error(), \"status=401\") }","tryCatchPattern":"assets, err := client.SessionScope(ctx, token, atype)\nif err != nil {\n    var srvMsg string\n    if m := serverErrorText(err); m != \"\" { srvMsg = m } // parse error=... suffix\n    log.Printf(\"scope lookup failed: %v (%s)\", err, srvMsg)\n    return err\n}","preventionTips":["Surface the server's error= message to callers instead of swallowing it.","Handle 401 by re-authenticating automatically.","Validate asset types against the server's supported list.","Add retries with backoff only for 5xx statuses."],"tags":["http","api-client","server-error"],"backgroundTag":"http-error-response","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}