{"record":{"id":"435e1637b0867697","repo":"elsa-workflows/elsa-core","slug":"secret-secret-name-could-not-be-resolved","errorCode":null,"errorMessage":"Secret '{secret.Name}' could not be resolved.","messagePattern":"Secret '(.+?)' could not be resolved\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs","lineNumber":161,"sourceCode":"        {\n            return new SecretTestResponse { Succeeded = false, Error = e.Message };\n        }\n    }\n\n    public async Task<SecretPayload> ResolvePayloadAsync(string name, CancellationToken cancellationToken = default)\n    {\n        var secret = await GetExistingAsync(name, cancellationToken);\n        return await ResolvePayloadAsync(secret, cancellationToken);\n    }\n\n    public async Task<SecretPayload> ResolvePayloadAsync(Secret secret, CancellationToken cancellationToken = default)\n    {\n        var version = GetLatestActiveVersion(secret);\n        var store = storeRegistry.Get(secret.StoreName);\n        var payload = await store.ReadAsync(secret, version, cancellationToken);\n\n        if (payload?.Value == null)\n            throw new InvalidOperationException($\"Secret '{secret.Name}' could not be resolved.\");\n\n        return payload;\n    }\n\n    private async Task<Secret> CreateSecretAsync(CreateSecretRequest request, CancellationToken cancellationToken)\n    {\n        var typeProvider = typeRegistry.Get(request.TypeName);\n        var store = storeRegistry.Get(request.StoreName);\n        EnsureCanWrite(store);\n\n        if (!typeProvider.Descriptor.SupportedStoreNames.Contains(store.Name, StringComparer.OrdinalIgnoreCase))\n            throw new InvalidOperationException($\"Secret type '{request.TypeName}' does not support store '{request.StoreName}'.\");\n\n        if (!typeProvider.Validate(request, out var error))\n            throw new InvalidOperationException(error);\n\n        var secret = new Secret\n        {","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs#L143-L179","documentation":"Thrown by DefaultSecretManager.ResolvePayloadAsync when the secret store returns a null payload or a payload with a null Value for the secret's latest active version. It means the secret is registered and active, but its actual value could not be read from the backing store.","triggerScenarios":"Calling ISecretManager.ResolvePayloadAsync(name or secret) where store.ReadAsync yields null or SecretPayload.Value == null - e.g. the underlying value was deleted from the store, an environment/configuration-backed store has no value bound for the key, or a read failure was swallowed into a null result.","commonSituations":"Configuration-backed stores where the referenced configuration key was removed or renamed, external stores where the value was deleted out-of-band, or stores that cannot decrypt a payload written by a different key/tenant.","solutions":["Verify the value still exists in the backing store for the secret's StoreName and re-write it if missing (store.WriteAsync or rotate the secret).","For configuration-backed stores, check that the configuration key (often in payload Metadata 'configurationKey') is present in appsettings/environment.","Rotate the secret to write a fresh value: manager.RotateAsync(name, new RotateSecretRequest { Value = ... }).","Catch InvalidOperationException around ResolvePayloadAsync and fall back to a default or fail fast with a clear message."],"exampleFix":"// before\nvar payload = await manager.ResolvePayloadAsync(\"api-key\"); // throws if value gone\n// after\ntry { var payload = await manager.ResolvePayloadAsync(\"api-key\"); }\ncatch (InvalidOperationException) { await manager.RotateAsync(\"api-key\", new RotateSecretRequest { Value = freshValue }); }","handlingStrategy":"try-catch","validationCode":"// Verify the backing value exists before resolving\nvar secret = await manager.GetAsync(name);\nvar present = secret is { Status: SecretStatus.Active } && await storeRegistry.Get(secret.StoreName).TestAsync(secret, secret.LatestActiveVersion!, ct);","typeGuard":null,"tryCatchPattern":"try { var payload = await manager.ResolvePayloadAsync(name); }\ncatch (InvalidOperationException e) when (e.Message.Contains(\"could not be resolved\")) { /* alert ops; rotate or restore the store value */ }","preventionTips":["Monitor configuration-backed keys referenced by secrets (configurationKey metadata).","Use TestAsync as a health probe for secret stores.","Never delete backing values without revoking/rotating the secret first."],"tags":["secrets","store","resolution","null-value"],"backgroundTag":"record-not-found","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}