owasp-amass/amass · error · ErrBadRequest

bad request

Error message

bad request

What it means

ErrBadRequest is the sentinel returned when the request body cannot be used. readRawJSON returns it when the raw JSON body is empty, signaling HTTP 400 to API callers that a non-empty JSON body is required.

Source

Thrown at engine/api/server/v1/handlers.go:63

type AddAssetResponse struct {
	EntityID string `json:"entityID"`
}

// Bulk typed add: {"items":[ <OAM obj>, <OAM obj>, ... ]}
// where each item is arbitrary JSON object without "type".
type BulkAddAssetsRequest struct {
	Items []json.RawMessage `json:"items"`
}

type BulkAddAssetsResponse struct {
	Ingested int64 `json:"ingested"`
	Stored   int64 `json:"stored"`
	Failed   int64 `json:"failed"`
}

var (
	ErrNotFound   = errors.New("not found")
	ErrBadRequest = errors.New("bad request")
)

type V1Handlers struct {
	ctx context.Context
	log *slog.Logger
	dis et.Dispatcher
	mgr et.SessionManager
}

func NewV1Handlers(ctx context.Context, dis et.Dispatcher, mgr et.SessionManager, log *slog.Logger) (*V1Handlers, error) {
	return &V1Handlers{
		ctx: ctx,
		log: log,
		dis: dis,
		mgr: mgr,
	}, nil
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Send a non-empty JSON body with the correct Content-Type: application/json.
2. Inspect the client code to ensure the payload is actually serialized and attached.
3. Handle HTTP 400 client-side and retry with a valid payload.
4. Check for early-terminated writes or streaming failures in the client.

Example fix

# before
curl -X POST http://host/v1/assets/typed
# after
curl -X POST http://host/v1/assets/typed -H 'Content-Type: application/json' -d '{"scope":"example.com","asset":"a.example.com"}'

payload, err := json.Marshal(body)
if err != nil { return err }
if len(payload) == 0 { return errors.New("request body must be non-empty JSON") }

resp, err := client.Do(req)
if err != nil { return err }
if resp.StatusCode == http.StatusBadRequest {
    return fmt.Errorf("request rejected (bad request): check JSON body is non-empty and valid")
}

When it happens

Trigger: Calling a v1 endpoint that reads a JSON body (via readRawJSON) with an empty body — e.g. POST/PUT without a payload, or a client that serializes nothing — making len(raw) == 0.

Common situations: Testing the API with curl without -d '{...}', an HTTP client sending no body on ingest endpoints like AddAssetTyped/AddAssetsBulk, or Content-Length 0 due to client serialization bugs.

Related errors

• not found
• too many items in bulk request
• createSession: status=%s
• createSession: status=%s error=%s
• listSessions: status=%s

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/985cb3f0390e2386. Report an issue: GitHub.