failed to create the jurisdiction claim %s for organization

Error message

failed to create the jurisdiction claim %s for organization %s

What it means

CreateOrgJurisdictionClaim adds a SimplePropertyClaim (property name 'jurisdiction', value the jurisdiction string) linking to the Organization asset. If that claim-creation call returns an error, the function discards the underlying cause and returns this generic failure message including the jurisdiction and the organization's key.

Source

Thrown at engine/plugins/support/org/claims.go:149

			}
		}
	}

	return nil, fmt.Errorf("failed to obtain the Organization associated with Identifier - %s:%s", oamgen.LegalName, name)
}

func CreateOrgJurisdictionClaim(sess et.Session, orgent *dbt.Entity, jurisdiction string) error {
	ctx, cancel := context.WithTimeout(sess.Ctx(), 10*time.Second)
	defer cancel()

	if _, err := sess.DB().CreateEntityProperty(ctx, orgent, &oamgen.SimpleProperty{
		PropertyName:  "jurisdiction",
		PropertyValue: jurisdiction,
	}); err == nil {
		return nil
	}

	return fmt.Errorf("failed to create the jurisdiction claim %s for organization %s", jurisdiction, orgent.Asset.Key())
}

func FindOrgByNormNameAndJurisdictionClaim(sess et.Session, norm, jurisdiction string) (*dbt.Entity, error) {
	var country string
	if parts := strings.Split(jurisdiction, "-"); len(parts) == 2 {
		country = parts[0]
	}

	ctx, cancel := context.WithTimeout(sess.Ctx(), 10*time.Second)
	defer cancel()

	orgents, err := sess.DB().FindEntitiesByContent(ctx, oam.Organization, time.Time{}, 1, dbt.ContentFilters{
		"name": norm,
	})
	if err != nil || len(orgents) == 0 {
		return nil, fmt.Errorf("failed to obtain organizations with norm name %s", norm)
	}

View on GitHub (pinned to 79299dce87)

Solutions

Inspect the code to see the discarded error from the claim-creation call (the err is swallowed) — add logging around that call to surface the real cause.
Verify the asset DB is writable and responsive; check for write contention between concurrent scans.
Confirm the jurisdiction value is a valid country code (CreateOrgAsset normalizes via countries.ByName before calling).
Retry the operation: the claim is idempotent, so re-running the scan/plugin recreates it.

Example fix

// before
if err := claim(...); err == nil {
    return nil
}
return fmt.Errorf("failed to create the jurisdiction claim %s for organization %s", jurisdiction, orgent.Asset.Key())
// after
if err := claim(...); err == nil {
    return nil
} else {
    return fmt.Errorf("failed to create the jurisdiction claim %s for organization %s: %w", jurisdiction, orgent.Asset.Key(), err)
}

Defensive patterns

Strategy: try-catch

Validate before calling

if orgent == nil || orgent.Asset == nil || jurisdiction == "" {
    return errors.New("cannot create jurisdiction claim: missing organization or jurisdiction")
}

Try / catch

if err := org.CreateOrgJurisdictionClaim(sess, orgent, jurisdiction); err != nil {
    log.Printf("jurisdiction claim failed for %s: %v (underlying DB write error is discarded upstream)", orgent.Asset.Key(), err)
    // retry later; claim creation is idempotent
}

Prevention

Log the discarded underlying error by wrapping the inner claim call.
Ensure the DB backend is writable and not under contention.
Validate jurisdiction is a valid country code before calling.
Retry failed claim writes; they are idempotent.

When it happens

Trigger: Called by CreateOrgAsset after resolving/creating the Organization; the underlying AddSimplePropertyClaim-style call fails — typically a DB write error, context timeout (10s), or the asset being concurrently deleted. The wrapped error is discarded, so only this message surfaces.

Common situations: Asset DB write contention or outage during heavy scans; jurisdiction string invalid/empty reaching the claim writer; the 10s context expires under DB latency; concurrent plugins mutating the same Organization asset.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/617ff2cb857d6bfb. Report an issue: GitHub.