owasp-amass/amass · warning

failed to obtain the entity for Identifier - %s:%s

Error message

failed to obtain the entity for Identifier - %s:%s

What it means

FindOrgByRDAPHandle throws this when the database lookup for the ARIN RDAP handle entity does not return exactly one matching entity. FindEntitiesByContent is queried with the identifier and a content filter {id: handle, id_type: ARINHandle}; any error, zero hits, or multiple hits produce this error. It means the entity for the RDAP handle could not be uniquely resolved.

Source

Thrown at engine/plugins/support/org/rdap.go:58

	}

	if err := createRelation(ctx, sess, orgent, &oamgen.SimpleRelation{Name: "id"}, ident, src); err != nil {
		return nil, err
	}

	return ident, nil
}

func FindOrgByRDAPHandle(sess et.Session, handle string, src *et.Source) (*dbt.Entity, error) {
	ctx, cancel := context.WithTimeout(sess.Ctx(), 30*time.Second)
	defer cancel()

	ids, err := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 1, dbt.ContentFilters{
		"id":      handle,
		"id_type": oamgen.ARINHandle,
	})
	if err != nil || len(ids) != 1 {
		return nil, fmt.Errorf("failed to obtain the entity for Identifier - %s:%s", oamgen.ARINHandle, handle)
	}
	ident := ids[0]

	if edges, err := sess.DB().IncomingEdges(ctx, ident, time.Time{}, "id"); err == nil && len(edges) > 0 {
		for _, edge := range edges {
			if tags, err := sess.DB().FindEdgeTags(ctx, edge, time.Time{}, src.Name); err != nil || len(tags) == 0 {
				continue
			}
			if o, err := sess.DB().FindEntityById(ctx, edge.FromEntity.ID); err == nil && o != nil {
				if _, valid := o.Asset.(*oamorg.Organization); valid {
					return o, nil
				}
			}
		}
	}

	return nil, fmt.Errorf("failed to obtain the Organization associated with Identifier - %s:%s", oamgen.ARINHandle, handle)
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Re-run the ARIN/RDAP enumeration so the handle entity is stored before this lookup
2. Inspect the DB for duplicate entities with that id/id_type and deduplicate
3. Confirm the handle string format matches what was stored (exact match on id)
4. Check DB connectivity/session errors surfaced in err before assuming the data is missing
5. Log the returned ids count to distinguish zero-hit vs multi-hit ambiguity

Example fix

// before
ids, err := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 1, dbt.ContentFilters{"id": handle, "id_type": oamgen.ARINHandle})
if err != nil || len(ids) != 1 {
    return nil, fmt.Errorf("failed to obtain the entity for Identifier - %s:%s", oamgen.ARINHandle, handle)
}
// after
ids, err := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 2, dbt.ContentFilters{"id": handle, "id_type": oamgen.ARINHandle})
if err != nil {
    return nil, fmt.Errorf("entity lookup error: %v", err)
}
if len(ids) == 0 {
    return nil, fmt.Errorf("no entity stored for handle %s; run RDAP enumeration first", handle)
}
ident := ids[0]

// Go: confirm the handle entity exists before the lookup
ids, _ := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 2, dbt.ContentFilters{"id": handle, "id_type": oamgen.ARINHandle})
if len(ids) != 1 {
    return nil, fmt.Errorf("handle %s not uniquely resolvable (%d matches); rerun ARIN enumeration", handle, len(ids))
}

func isEntityLookupFailure(err error) bool {
    return err != nil && strings.Contains(err.Error(), "failed to obtain the entity for Identifier")
}

ident, err := FindOrgByRDAPHandle(ctx, sess, e, oam, handle)
if err != nil {
    if isEntityLookupFailure(err) {
        return nil, nil // skip: handle entity not present/ambiguous
    }
    return nil, err
}

When it happens

Trigger: Calling FindOrgByRDAPHandle (via storeEntity) when: the DB query FindEntitiesByContent returns an error; no entity exists with id == handle and id_type == ARINHandle; or more than one entity matches so the result is ambiguous (len(ids) != 1).

Common situations: The RDAP/ARIN handle was never stored because the whois-arin source has not run or the handle data changed; duplicate entities with the same handle exist from repeated/parallel ingestions; stale DB contents after a schema or handle-format change; transient DB errors (closed session, context timeout).

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• failed to obtain the Organization associated with Identifier
• failed to obtain the Amass output directory
• failed to create the RDAP disk cache
• failed to create the OAM Service asset
• failed to create the Organization asset

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/037471990c10fe9c. Report an issue: GitHub.