owasp-amass/amass · info

failed to obtain the entity for Identifier - %s:%s

Error message

failed to obtain the entity for Identifier - %s:%s

What it means

FindOrgByNameClaim looks up an Organization entity in the asset graph by a name-type Identifier claim (id + id_type=organization_name). If FindEntitiesByContent errors or does not return exactly one identifier entity, the lookup is inconclusive and this error is returned rather than guessing which entity is meant.

Source

Thrown at engine/plugins/support/org/claims.go:59

	}

	if err := createRelation(ctx, sess, orgent, &oamgen.SimpleRelation{Name: "id"}, ident, src); err != nil {
		return nil, err
	}

	return ident, nil
}

func FindOrgByNameClaim(sess et.Session, name string, src *et.Source) (*dbt.Entity, error) {
	ctx, cancel := context.WithTimeout(sess.Ctx(), 30*time.Second)
	defer cancel()

	ids, err := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 1, dbt.ContentFilters{
		"id":      name,
		"id_type": oamgen.OrganizationName,
	})
	if err != nil || len(ids) != 1 {
		return nil, fmt.Errorf("failed to obtain the entity for Identifier - %s:%s", oamgen.OrganizationName, name)
	}
	ident := ids[0]

	if edges, err := sess.DB().IncomingEdges(ctx, ident, time.Time{}, "id"); err == nil && len(edges) > 0 {
		for _, edge := range edges {
			if tags, err := sess.DB().FindEdgeTags(ctx, edge, time.Time{}, src.Name); err != nil || len(tags) == 0 {
				continue
			}
			if o, err := sess.DB().FindEntityById(ctx, edge.FromEntity.ID); err == nil && o != nil {
				if _, valid := o.Asset.(*oamorg.Organization); valid {
					return o, nil
				}
			}
		}
	}

	return nil, fmt.Errorf("failed to obtain the Organization associated with Identifier - %s:%s", oamgen.OrganizationName, name)
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Treat the error as a cache miss: callers like CreateOrgAsset intentionally fall through to create a new Organization asset, so verify whether the org genuinely does not exist before treating it as a fault.
2. Check the asset DB backend is reachable and healthy (connection, schema) since err != nil is folded into this message.
3. Search the graph for duplicate organization_name identifier entities for this name and remove duplicates so exactly one match exists.
4. Ensure the name passed matches the stored claim exactly (same casing/normalization) or provide a LegalName/RegistrationID so the caller can use alternative lookups.
5. If the 30s context timeout is the cause, address DB latency or increase the timeout.

// caller-side guard before expecting an org to exist
ids, err := sess.DB().FindEntitiesByContent(ctx, oam.Identifier, time.Time{}, 1, dbt.ContentFilters{"id": name, "id_type": oamgen.OrganizationName})
if err != nil || len(ids) != 1 {
    // treat as not-found: proceed with creation or use alternate lookup keys
}

func hasSingleIdentifier(ids []*dbt.Entity) bool { return len(ids) == 1 }

if orgent, err := org.FindOrgByNameClaim(sess, name, src); err != nil {
    // not-found is expected on first discovery: fall back to legal-name or create a new asset
    orgent, _ = org.FindOrgByLegalNameClaim(sess, legalName, src)
}

When it happens

Trigger: CreateOrgAsset calls FindOrgByNameClaim with an organization name that (a) has no organization_name identifier entity yet in the graph, (b) has multiple matching identifier entities (ambiguous), or (c) the underlying FindEntitiesByContent query fails (DB error or the 30s context times out).

Common situations: First run where the org was never discovered before; the graph DB is unavailable or slow so the DB query errors; another data source previously stored a duplicate organization_name identifier so len(ids) != 1; name casing/normalization differs from what was stored.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• failed to obtain the Organization associated with Identifier
• failed to obtain organizations with norm name %s
• failed to obtain the Organization associated with norm name
• failed to obtain the Organization associated with jurisdicti
• failed to obtain the entity for Identifier - %s:%s

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/44bacf7864dc3648. Report an issue: GitHub.