What causes "too many items in bulk request" in owasp-amass/amass?

Split the items array into chunks of at most maxBulkItems and issue one bulk request per chunk

too many items in bulk request

Error message

too many items in bulk request

What it means

The bulk asset-addition endpoint enforces a hard cap of maxBulkItems items per request. When req.Items exceeds that limit, the handler responds with HTTP 413 and this message, refusing to process any of the items rather than partially ingesting them.

Source

Thrown at engine/api/server/v1/handlers.go:421

	sess := v.mgr.GetSession(token)
	if sess == nil {
		writeError(w, http.StatusNotFound, "session not found", ErrNotFound)
		return
	}

	var req BulkAddAssetsRequest
	dec := json.NewDecoder(r.Body)
	if err := dec.Decode(&req); err != nil {
		writeError(w, http.StatusBadRequest, "invalid JSON", err)
		return
	}
	if len(req.Items) == 0 {
		writeError(w, http.StatusBadRequest, "items must be non-empty", nil)
		return
	}
	if len(req.Items) > maxBulkItems {
		writeError(w, http.StatusRequestEntityTooLarge,
			"too many items in bulk request", errors.New("max items exceeded"))
		return
	}

	assets := make([]oam.Asset, 0, len(req.Items))
	for _, raw := range req.Items {
		if a, err := parseAsset(assetType, raw); err == nil {
			assets = append(assets, a)
		}
	}

	ingested := int64(len(assets))
	if ingested == 0 {
		writeError(w, http.StatusBadRequest, "no valid JSON objects in items", nil)
		return
	}

	stored, err := v.PutAssets(v.ctx, sess, assets)
	if err != nil {

View on GitHub (pinned to 79299dce87)

Solutions

Split the items array into chunks of at most maxBulkItems and issue one bulk request per chunk
Check the server's maxBulkItems constant and align client batch size to it
Add client-side pagination of asset batches before calling the bulk endpoint
If 413 is persisted by an intermediate proxy, ensure the response is surfaced to the caller rather than retried

Example fix

// before
client.BulkAdd(allAssets) // thousands of items
// after
for chunk := range lo.Chunk(allAssets, maxBulkItems) {
    client.BulkAdd(chunk)
}

Defensive patterns

Strategy: validation

Validate before calling

if len(items) > maxBulkItems {
    return fmt.Errorf("bulk request has %d items, max is %d", len(items), maxBulkItems)
}

Try / catch

resp, err := client.BulkAdd(items)
if err != nil {
    var apiErr *APIError
    if errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusRequestEntityTooLarge {
        // split items into chunks and retry per chunk
    }
}

Prevention

Chunk client-side batches to a size at or below maxBulkItems
Keep client batch size in sync with the server constant after upgrades
Surface HTTP 413 responses to logs instead of silently retrying

When it happens

Trigger: POSTing to the AddAssetsBulkHandler v1 endpoint with a JSON body whose items array contains more than maxBulkItems entries.

Common situations: Batch scripts or integrations that dump an entire enumeration's asset list into one request; a client not paginating/chunking after a maxBulkItems constant change in a newer version.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/6c337024594c230e. Report an issue: GitHub.