owasp-amass/amass · error

CreateAssetsBulk: too many items; max=%d

Error message

CreateAssetsBulk: too many items; max=%d

What it means

CreateAssetsBulk enforces a client-side maximum batch size (MaxBulkItems) to keep the bulk POST payload reasonable. Supplying more assets than the limit rejects the entire call before any network request, protecting both client and server from oversized requests.

Source

Thrown at engine/api/client/v1/client.go:258

		return "", fmt.Errorf("createAsset: status=%s error=%s", resp.Status, msg)
	}

	var r AddAssetResponse
	if err := json.Unmarshal([]byte(resp.Body), &r); err != nil {
		return "", err
	}
	return r.EntityID, nil
}

// Creates multiple assets in bulk on the server associated with the provided token.
func (c *Client) CreateAssetsBulk(ctx context.Context, token uuid.UUID, atype string, assets []oam.Asset) (int, error) {
	atype = strings.ToLower(strings.TrimSpace(atype))

	if atype == "" {
		return 0, fmt.Errorf("CreateAssetsBulk: asset type required")
	}
	if len(assets) > MaxBulkItems {
		return 0, fmt.Errorf("CreateAssetsBulk: too many items; max=%d", MaxBulkItems)
	}

	items := make([]json.RawMessage, 0, len(assets))
	for _, asset := range assets {
		if !strings.EqualFold(atype, string(asset.AssetType())) {
			return 0, fmt.Errorf("CreateAssetsBulk: mixed asset types not allowed")
		}

		raw, err := asset.JSON()
		if err != nil {
			return 0, err
		}
		items = append(items, json.RawMessage(raw))
	}

	sessionID := token.String()
	body, _ := json.Marshal(BulkAddAssetsRequest{Items: items})
	u := fmt.Sprintf("%s/sessions/%s/assets/%s:bulk", c.base, sessionID, atype)

View on GitHub (pinned to 79299dce87)

Solutions

1. Split the asset slice into chunks of at most MaxBulkItems and call CreateAssetsBulk per chunk.
2. Check MaxBulkItems in this package to size batches correctly.
3. Buffer assets through a queue that flushes when the chunk limit is reached.
4. Reduce per-call volume by flushing assets incrementally during collection.

Example fix

// before
count, err := client.CreateAssetsBulk(ctx, token, atype, allAssets)
// after
for len(allAssets) > 0 {
    end := min(len(allAssets), MaxBulkItems)
    if _, err := client.CreateAssetsBulk(ctx, token, atype, allAssets[:end]); err != nil { return err }
    allAssets = allAssets[end:]
}

if len(assets) > MaxBulkItems { return fmt.Errorf("%d assets exceed MaxBulkItems=%d", len(assets), MaxBulkItems) }

func withinBulkLimit(assets []oam.Asset) bool { return len(assets) <= MaxBulkItems }

if !withinBulkLimit(assets) {
    for chunk := range slices.Chunk(assets, MaxBulkItems) {
        if _, err := client.CreateAssetsBulk(ctx, token, atype, chunk); err != nil { return err }
    }
    return nil
}

When it happens

Trigger: Calling Client.CreateAssetsBulk with len(assets) > MaxBulkItems — e.g. passing thousands of collected assets from a large enumeration in one call.

Common situations: Batching logic that collects assets for a whole scan without chunking; long-running sessions that accumulate assets faster than they are flushed.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• CreateAssetsBulk: asset type required
• CreateAssetsBulk: mixed asset types not allowed
• brute forcing cannot be performed without DNS resolution
• active enumeration cannot be performed without DNS resolutio
• resolvers section is not a list

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/03e6cf480b2f05aa. Report an issue: GitHub.