What causes "addAssetsBulk: status=%s" in owasp-amass/amass?

Check the HTTP status in the message; 413/502 usually means the batch is too large — chunk it further.

addAssetsBulk: status=%s

Error message

addAssetsBulk: status=%s

What it means

CreateAssetsBulk POSTs the batch to {base}/sessions/{token}/assets/{atype}:bulk. When the server responds non-200 and the body cannot be parsed as a JSON error, the client raises this bare status error; none (or only some) of the assets were stored and no server explanation is available.

Source

Thrown at engine/api/client/v1/client.go:290

	}

	sessionID := token.String()
	body, _ := json.Marshal(BulkAddAssetsRequest{Items: items})
	u := fmt.Sprintf("%s/sessions/%s/assets/%s:bulk", c.base, sessionID, atype)
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{
		URL:    u,
		Body:   string(body),
		Method: http.MethodPost,
		Header: amasshttp.Header{"Content-Type": []string{"application/json"}},
	})
	if err != nil {
		return 0, err
	}

	if resp.StatusCode != http.StatusOK {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return 0, fmt.Errorf("addAssetsBulk: status=%s", resp.Status)
		}
		return 0, fmt.Errorf("addAssetsBulk: status=%s error=%s", resp.Status, msg)
	}

	var out BulkAddAssetsResponse
	if err := json.Unmarshal([]byte(resp.Body), &out); err != nil {
		return 0, err
	}
	return int(out.Stored), nil
}

// Subscribe to receive a stream of log messages from the server.
func (c *Client) Subscribe(ctx context.Context, token uuid.UUID) (<-chan string, error) {
	u, err := url.Parse(c.base)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 79299dce87)

Solutions

Check the HTTP status in the message; 413/502 usually means the batch is too large — chunk it further.
Verify the token is from an active session.
Inspect server/proxy logs for the failing request.
Retry with smaller batches on 5xx.
Ensure the server version supports the :bulk endpoint.

Example fix

// before
count, err := client.CreateAssetsBulk(ctx, token, atype, assets) // bare status error
// after
const chunk = 100
for i := 0; i < len(assets); i += chunk {
    end := min(i+chunk, len(assets))
    if _, err := client.CreateAssetsBulk(ctx, token, atype, assets[i:end]); err != nil { return err }
}

Defensive patterns

Strategy: retry

Validate before calling

if token == uuid.Nil { return errors.New("session token not initialized") }
if len(assets) == 0 || len(assets) > MaxBulkItems { return errors.New("invalid bulk batch size") }

Type guard

func isTransientStatus(err error) bool { s := err.Error(); return strings.Contains(s, "status=502") || strings.Contains(s, "status=503") || strings.Contains(s, "status=504") }

Try / catch

count, err := client.CreateAssetsBulk(ctx, token, atype, assets)
if err != nil && isTransientStatus(err) {
    return retryWithBackoff(3, func() error { _, err = client.CreateAssetsBulk(ctx, token, atype, assets); return err })
}

Prevention

Retry only transient 5xx failures with exponential backoff.
Split very large batches to avoid proxy body-size limits (413).
Keep sessions alive across long bulk operations.
Correlate failures with server logs via timestamps.

When it happens

Trigger: Calling CreateAssetsBulk when the server rejects the bulk POST with a non-JSON body — unknown session (401/404 HTML page), request entity too large (413 from proxy), or 5xx with empty body.

Common situations: Oversized bulk payload rejected by a reverse proxy with an HTML error page, server crash mid-request returning an empty 500, or stale token after server restart.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/5e0840139925b2c5. Report an issue: GitHub.