owasp-amass/amass · warning

failed to obtain the Organization associated with Identifier

Error message

failed to obtain the Organization associated with Identifier - %s:%s

What it means

FindOrgByLEICode in the org support package returns this error when it cannot resolve an Organization for a given LEI (Legal Entity Identifier) code. After exhausting its lookup paths (e.g. cached candidates matching the LEI via GLEIF data), the function falls through to a final sentinel error. It is a lookup-failure signal, not a runtime/infra error — the data simply was not found or did not match.

Source

Thrown at engine/plugins/support/org/gleif.go:75

	if err != nil || len(ids) != 1 {
		return nil, fmt.Errorf("failed to obtain the entity for Identifier - %s:%s", oamgen.LEICode, lei)
	}
	ident := ids[0]

	if edges, err := sess.DB().IncomingEdges(ctx, ident, time.Time{}, "id"); err == nil && len(edges) > 0 {
		for _, edge := range edges {
			if tags, err := sess.DB().FindEdgeTags(ctx, edge, time.Time{}, src.Name); err != nil || len(tags) == 0 {
				continue
			}
			if o, err := sess.DB().FindEntityById(ctx, edge.FromEntity.ID); err == nil && o != nil {
				if _, valid := o.Asset.(*oamorg.Organization); valid {
					return o, nil
				}
			}
		}
	}

	return nil, fmt.Errorf("failed to obtain the Organization associated with Identifier - %s:%s", oamgen.LEICode, lei)
}

View on GitHub (pinned to 79299dce87)

Solutions

  1. Verify the LEI code is valid and exists in GLEIF (check via GLEIF API) before calling
  2. Run the enumeration/data-ingestion stage that populates Organizations and their LEI tags first
  3. Check the identifier/LEI for typos, casing, or whitespace normalization issues
  4. Treat the error as expected for unknown LEIs: handle the not-found case in the caller instead of treating it as a bug
  5. Log the exact lei value passed in to confirm the right key was used

Example fix

// before
org, err := FindOrgByLEICode(ctx, sess, oam, lei)
if err != nil {
    return fmt.Errorf("lookup failed: %v", err)
}
// after
org, err := FindOrgByLEICode(ctx, sess, oam, lei)
if err != nil {
    if strings.Contains(err.Error(), "failed to obtain the Organization") {
        return nil, ErrOrgNotFound // expected: LEI not in dataset
    }
    return fmt.Errorf("lookup failed: %v", err)
}
Defensive patterns

Strategy: try-catch

Validate before calling

// Go: check the LEI is well-formed before lookup
func validLEI(lei string) bool {
    return len(lei) == 20 && regexp.MustCompile(`^[A-Z0-9]{20}$`).MatchString(lei)
}
if !validLEI(lei) { return nil, fmt.Errorf("invalid LEI: %q", lei) }

Type guard

func isOrgNotFound(err error) bool {
    return err != nil && strings.Contains(err.Error(), "failed to obtain the Organization associated with Identifier")
}

Try / catch

org, err := FindOrgByLEICode(ctx, sess, oam, lei)
if err != nil {
    if isOrgNotFound(err) {
        return nil, nil // not-found is an expected outcome
    }
    return nil, err
}

Prevention

When it happens

Trigger: Calling FindOrgByLEICode with an LEI code that has no matching Organization in the database/GLEIF-derived cache; the candidate loop over orgs associated with the identifier completes without a match (no org's LEI equals the requested lei).

Common situations: An LEI code is new, expired, or never ingested so no GLEIF record exists locally; typo'd or normalized-differently LEI (case/whitespace); reverse relation from identifier to organization was never created by an earlier enumeration stage; calling the lookup before the GLEIF source has run.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/9b24dc808f1a86c1. Report an issue: GitHub.