What causes "createAsset: status=%s" in owasp-amass/amass?

Check resp.Status in the message for 4xx vs 5xx to decide client vs server fix.

createAsset: status=%s

Error message

createAsset: status=%s

What it means

CreateAsset POSTs a single asset to {base}/sessions/{token}/assets/{atype}. When the server returns a non-200 status and the body cannot be parsed as a JSON error, the client raises this bare status error. It means the asset was not stored and no server-side explanation was available.

Source

Thrown at engine/api/client/v1/client.go:238

		return "", err
	}

	sessionID := token.String()
	u := fmt.Sprintf("%s/sessions/%s/assets/%s", c.base, sessionID, atype)
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{
		URL:    u,
		Body:   string(raw),
		Method: http.MethodPost,
		Header: amasshttp.Header{"Content-Type": []string{"application/json"}},
	})
	if err != nil {
		return "", err
	}

	if resp.StatusCode != http.StatusOK {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return "", fmt.Errorf("createAsset: status=%s", resp.Status)
		}
		return "", fmt.Errorf("createAsset: status=%s error=%s", resp.Status, msg)
	}

	var r AddAssetResponse
	if err := json.Unmarshal([]byte(resp.Body), &r); err != nil {
		return "", err
	}
	return r.EntityID, nil
}

// Creates multiple assets in bulk on the server associated with the provided token.
func (c *Client) CreateAssetsBulk(ctx context.Context, token uuid.UUID, atype string, assets []oam.Asset) (int, error) {
	atype = strings.ToLower(strings.TrimSpace(atype))

	if atype == "" {
		return 0, fmt.Errorf("CreateAssetsBulk: asset type required")
	}

View on GitHub (pinned to 79299dce87)

Solutions

Check resp.Status in the message for 4xx vs 5xx to decide client vs server fix.
Verify the asset serializes correctly (asset.JSON()) and matches the atype endpoint segment.
Confirm the token maps to an active session.
Bypass or inspect any proxy between client and server that may inject HTML error pages.
Check server logs for the failed POST.

Example fix

// before
client.CreateAsset(ctx, token, asset) // fails with bare status
// after
if _, err := asset.JSON(); err != nil { return fmt.Errorf("asset not serializable: %w", err) }
id, err := client.CreateAsset(ctx, token, asset)

Defensive patterns

Strategy: validation

Validate before calling

raw, err := asset.JSON()
if err != nil { return fmt.Errorf("asset not serializable: %w", err) }
if token == uuid.Nil { return errors.New("session token not initialized") }

Type guard

func canSerialize(a oam.Asset) bool { _, err := a.JSON(); return err == nil }

Try / catch

id, err := client.CreateAsset(ctx, token, asset)
if err != nil {
    if strings.Contains(err.Error(), "status=5") { /* retry with backoff */ }
    return fmt.Errorf("createAsset failed: %w", err)
}

Prevention

Validate asset JSON serialization before sending.
Keep the HTTP path free of HTML-producing proxies, or set proper Accept headers.
Ensure sessions are active before posting assets.
Monitor for 413/5xx statuses and chunk work accordingly.

When it happens

Trigger: Calling Client.CreateAsset with an invalid/expired token, malformed asset JSON that the server rejects with a non-JSON error body, or a gateway/proxy returning an HTML error page (502/504).

Common situations: Reverse proxy timeout on large payloads, server not running the JSON error envelope version, or wrong base URL hitting an HTML 404 page.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/2e5c1ea8523fa9a1. Report an issue: GitHub.