failed to obtain the Organization associated with Identifier

Error message

failed to obtain the Organization associated with Identifier - %s:%s

What it means

FindOrgByNameClaim found the name Identifier entity but could not resolve it to an Organization asset: the incoming 'id' edges' tag filtering (by source) or edge target verification yielded no acceptable Organization. This error signals that the identifier exists in the graph but no Organization satisfying the claim's provenance was reachable from it.

Source

Thrown at engine/plugins/support/org/claims.go:76

	if err != nil || len(ids) != 1 {
		return nil, fmt.Errorf("failed to obtain the entity for Identifier - %s:%s", oamgen.OrganizationName, name)
	}
	ident := ids[0]

	if edges, err := sess.DB().IncomingEdges(ctx, ident, time.Time{}, "id"); err == nil && len(edges) > 0 {
		for _, edge := range edges {
			if tags, err := sess.DB().FindEdgeTags(ctx, edge, time.Time{}, src.Name); err != nil || len(tags) == 0 {
				continue
			}
			if o, err := sess.DB().FindEntityById(ctx, edge.FromEntity.ID); err == nil && o != nil {
				if _, valid := o.Asset.(*oamorg.Organization); valid {
					return o, nil
				}
			}
		}
	}

	return nil, fmt.Errorf("failed to obtain the Organization associated with Identifier - %s:%s", oamgen.OrganizationName, name)
}

func CreateOrgLegalNameClaim(sess et.Session, orgent *dbt.Entity, name string, src *et.Source) (*dbt.Entity, error) {
	ctx, cancel := context.WithTimeout(sess.Ctx(), 30*time.Second)
	defer cancel()

	id := &oamgen.Identifier{
		UniqueID: fmt.Sprintf("%s:%s", oamgen.LegalName, name),
		ID:       name,
		Type:     oamgen.LegalName,
	}

	ident, err := sess.DB().CreateAsset(ctx, id)
	if err != nil || ident == nil {
		return nil, err
	}

	_, err = sess.DB().CreateEntityProperty(ctx, ident, &oamgen.SourceProperty{

View on GitHub (pinned to 79299dce87)

Solutions

Verify the src *et.Source name matches the source that originally created the name claim; try the lookup with the original source or without source-based tag filtering.
Inspect the graph: confirm IncomingEdges from the identifier to an Organization asset exist and edge tags are populated.
Re-run discovery from a source that can re-create the claim, since CreateOrgAsset falls through and creates a fresh Organization plus claim.
Check for stale/partial graph state (edges deleted or tags missing) and rebuild the affected subgraph.

Defensive patterns

Strategy: fallback

Try / catch

if orgent, err := org.FindOrgByNameClaim(sess, name, src); err != nil {
    // identifier exists but claim/provenance mismatch: try other claim types or create new asset
    log.Printf("name claim unresolved for %s: %v", name, err)
}

Prevention

Keep source names stable across scans so edge tags match.
Re-create claims after graph pruning or migrations.
Inspect IncomingEdges/tags when lookups unexpectedly miss despite known claims.
Fall back to registration-ID or norm-name+jurisdiction lookups.

When it happens

Trigger: The organization_name Identifier entity exists, but IncomingEdges(ctx, ident, ..., "id") returns no edges, none of the edge tags match the requested source (FindEdgeTags with src.Name), or the edge's FromEntity fails verification as an Organization in the loop.

Common situations: Identifier entities were written by a different source than the one passed as src, so tag filtering rejects all edges; edges were pruned or the graph is partially built; the identifier was created without linking an Organization asset.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/236a95f2372e894e. Report an issue: GitHub.