{"record":{"id":"3f2bc14a5e976900","repo":"owasp-amass/amass","slug":"s-scope-status-s","errorCode":null,"errorMessage":"%s/scope: status=%s","messagePattern":"(.+?)/scope: status=(.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/api/client/v1/client.go","lineNumber":203,"sourceCode":"\t\treturn nil, err\n\t}\n\treturn &st, nil\n}\n\n// Retrieves scope for the session associated with the provided token.\nfunc (c *Client) SessionScope(ctx context.Context, token uuid.UUID, atype oam.AssetType) ([]oam.Asset, error) {\n\tsessionID := token.String()\n\tatypestr := strings.ToLower(string(atype))\n\tu := fmt.Sprintf(\"%s/sessions/%s/scope/%s\", c.base, sessionID, atypestr)\n\tresp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{URL: u})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tmsg, err := readJSONError(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"%s/scope: status=%s\", token.String(), resp.Status)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"%s/scope: status=%s error=%s\", token.String(), resp.Status, msg)\n\t}\n\n\treader := strings.NewReader(resp.Body)\n\treadCloser := io.NopCloser(reader)\n\tdefer func() { _ = readCloser.Close() }()\n\n\treturn apiclient.DecodeAssetsForScopeEndpoint(atype, readCloser)\n}\n\n// Creates a new asset on the server associated with the provided token.\nfunc (c *Client) CreateAsset(ctx context.Context, token uuid.UUID, asset oam.Asset) (string, error) {\n\tatype := strings.ToLower(string(asset.AssetType()))\n\traw, err := asset.JSON()\n\tif err != nil {\n\t\treturn \"\", err\n\t}","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/api/client/v1/client.go#L185-L221","documentation":"SessionScope retrieves the asset scope for a session via GET {base}/sessions/{token}/scope/{atype}. When the server responds with a non-200 status and the response body cannot be parsed as a JSON error (readJSONError fails), the client raises this error containing only the session token and HTTP status. It signals the scope request was rejected but the server's failure reason was unavailable/unparseable.","triggerScenarios":"Calling Client.SessionScope with a token whose session does not exist or has expired, a wrong oam.AssetType path segment, or when the server returns an error status (404/401/500) with an empty, HTML, or otherwise non-JSON body.","commonSituations":"Using a stale token after server restart, pointing the client at the wrong base URL (hitting a proxy/HTML error page), or an older server that does not emit the JSON error envelope.","solutions":["Verify the session token is valid and the session is still active on the server.","Check the base URL points at the engine API server, not a proxy returning HTML error pages.","Confirm the atype passed to SessionScope is a supported oam.AssetType spelled correctly.","Inspect server logs for the corresponding request to learn the real failure reason.","Add error handling that retries after re-establishing the session if the token expired."],"exampleFix":"// before\nassets, err := client.SessionScope(ctx, staleToken, oam.Domain)\n// after\ntok, err := ensureSession(ctx, client) // re-acquire token if expired\nif err != nil { return err }\nassets, err := client.SessionScope(ctx, tok, oam.Domain)","handlingStrategy":"try-catch","validationCode":"if token == uuid.Nil { return errors.New(\"session token not initialized\") }","typeGuard":"func hasToken(token uuid.UUID) bool { return token != uuid.Nil }","tryCatchPattern":"assets, err := client.SessionScope(ctx, token, atype)\nif err != nil {\n    if strings.Contains(err.Error(), \"status=401\") || strings.Contains(err.Error(), \"status=404\") {\n        // re-establish session then retry once\n    }\n    return err\n}","preventionTips":["Always obtain the token from a successful session setup call before querying scope.","Keep a handle on session lifetime; refresh tokens on long jobs.","Log the full error including status to distinguish auth vs routing problems.","Pin client and server to compatible versions."],"tags":["http","api-client","error-response"],"backgroundTag":"http-error-response","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}