owasp-amass/amass · info

failed to obtain the entity for Identifier - %s:%s

Error message

failed to obtain the entity for Identifier - %s:%s

What it means

FindOrgByLEICode looks up an Organization via its LEI Identifier entity (id_type=LEICode). If FindEntitiesByContent fails or does not return exactly one LEI identifier, this error is returned; LEI lookups are expected to be unique, so a non-single match is treated as inconclusive.

Source

Thrown at engine/plugins/support/org/gleif.go:58

	}

	if err := createRelation(ctx, sess, orgent, &oamgen.SimpleRelation{Name: "id"}, ident, src); err != nil {
		return nil, err
	}

	return ident, nil
}

func FindOrgByLEICode(sess et.Session, lei string, src *et.Source) (*dbt.Entity, error) {
	ctx, cancel := context.WithTimeout(sess.Ctx(), 30*time.Second)
	defer cancel()

	ids, err := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 1, dbt.ContentFilters{
		"id":      lei,
		"id_type": oamgen.LEICode,
	})
	if err != nil || len(ids) != 1 {
		return nil, fmt.Errorf("failed to obtain the entity for Identifier - %s:%s", oamgen.LEICode, lei)
	}
	ident := ids[0]

	if edges, err := sess.DB().IncomingEdges(ctx, ident, time.Time{}, "id"); err == nil && len(edges) > 0 {
		for _, edge := range edges {
			if tags, err := sess.DB().FindEdgeTags(ctx, edge, time.Time{}, src.Name); err != nil || len(tags) == 0 {
				continue
			}
			if o, err := sess.DB().FindEntityById(ctx, edge.FromEntity.ID); err == nil && o != nil {
				if _, valid := o.Asset.(*oamorg.Organization); valid {
					return o, nil
				}
			}
		}
	}

	return nil, fmt.Errorf("failed to obtain the Organization associated with Identifier - %s:%s", oamgen.LEICode, lei)
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Treat as a cache miss: the GLEIF plugin fetches org details from the GLEIF API and calls CreateOrgAsset to create the org and LEI claim.
2. Verify the LEI is the canonical 20-character form before lookup.
3. Check asset DB health if the query errored rather than returned zero rows.
4. Deduplicate if multiple LEI identifiers exist for the same code.

func isValidLEI(lei string) bool {
    return len(lei) == 20
}
// only query with a canonical LEI
if !isValidLEI(lei) { return nil, errors.New("invalid LEI") }

func isValidLEI(lei string) bool { return len(lei) == 20 }

if orgent, err := org.FindOrgByLEICode(sess, lei, src); err != nil {
    // cache miss: fetch from GLEIF API and CreateOrgAsset to persist org + LEI claim
    orgent, err = org.CreateOrgAsset(sess, nil, nil, fetchedOrg, src)
}

When it happens

Trigger: Called by store and getOrganization in the GLEIF plugin for an org's LEI; the graph has no LEI Identifier for that code, the query errors, or (unexpectedly) multiple LEI identifiers share the code.

Common situations: LEI never ingested before (expected cache miss in the GLEIF enrichment flow); asset DB unavailable; malformed/non-canonical LEI string (wrong length/checksum characters) not matching the stored claim; duplicate identifiers from concurrent ingestion.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• failed to obtain the entity for Identifier - %s:%s
• failed to obtain the Organization associated with Identifier
• failed to obtain organizations with norm name %s
• failed to obtain the Organization associated with norm name
• failed to obtain the Organization associated with jurisdicti

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/ce82aa1ae91ff87c. Report an issue: GitHub.