{"record":{"id":"991d2addc3dc8b95","repo":"kestra-io/kestra","slug":"the-encrypt-function-expects-two-arguments-key","errorCode":null,"errorMessage":"The 'encrypt' function expects two arguments 'key' and 'plaintext'.","messagePattern":"The 'encrypt' function expects two arguments 'key' and 'plaintext'\\.","errorType":"validation","errorClass":"PebbleException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/pebble/functions/EncryptFunction.java","lineNumber":32,"sourceCode":"    public static final String NAME = \"encrypt\";\n\n    @Override\n    public List<String> getArgumentNames() {\n        return List.of(\"key\", \"plaintext\");\n    }\n\n    @Override\n    public Map<String, String> getArgumentDefaults() {\n        return Map.of(\n            \"key\", SecretFunction.NAME + \"('encryption_key')\",\n            \"plaintext\", \"'value_to_encrypt'\"\n        );\n    }\n\n    @Override\n    public Object execute(Map<String, Object> args, PebbleTemplate self, EvaluationContext context, int lineNumber) {\n        if (!args.containsKey(\"key\") || !args.containsKey(\"plaintext\")) {\n            throw new PebbleException(null, \"The 'encrypt' function expects two arguments 'key' and 'plaintext'.\", lineNumber, self.getName());\n        }\n\n        String key = (String) args.get(\"key\");\n        String plaintext = (String) args.get(\"plaintext\");\n        try {\n            return EncryptionService.encrypt(key, plaintext);\n        } catch (GeneralSecurityException e) {\n            throw new PebbleException(e, e.getMessage(), lineNumber, self.getName());\n        }\n    }\n}\n","sourceCodeStart":14,"sourceCodeEnd":44,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/pebble/functions/EncryptFunction.java#L14-L44","documentation":"Thrown by the Pebble 'encrypt' template function when the args map is missing the 'key' or 'plaintext' entry. The function declares both as required positional arguments; Pebble only populates the map for arguments actually supplied at the call site, so omitting either (by position or by name) trips this guard before any crypto work is done.","triggerScenarios":"Calling encrypt() with one argument, encrypt('only-one'), encrypt(plaintext='x') without key, encrypt(key='k') without plaintext, or encrypt() with no arguments. Also hit if an argument name is misspelled so Pebble does not bind it to 'key' or 'plaintext'.","commonSituations":"Forgetting the second argument in a quick template; autocompleting from getArgumentDefaults() and leaving a placeholder; renaming arguments; copy-pasting a decrypt() call pattern and forgetting encrypt() takes 'plaintext' not 'encrypted'.","solutions":["Provide both arguments by position: encrypt(secret('ENCRYPTION_KEY'), 'value_to_encrypt').","If using named arguments, include both 'key' and 'plaintext' spelled exactly: encrypt(key=..., plaintext=...).","Remove any placeholder strings left from getArgumentDefaults() (e.g. \"'value_to_encrypt'\") and replace them with the real value."],"exampleFix":"# before\nenc: \"{{ encrypt(secret('ENCRYPTION_KEY')) }}\"\n# after\nenc: \"{{ encrypt(secret('ENCRYPTION_KEY'), my_value) }}\"","handlingStrategy":"validation","validationCode":"# Confirm both arguments are present before calling encrypt().\n# {{ (key != null and plaintext != null) ? encrypt(key, plaintext) : null }}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass both positional arguments to encrypt().","When using named args, include both 'key' and 'plaintext'.","Do not leave getArgumentDefaults() placeholders in production templates.","Lint flow YAML for encrypt( calls with fewer than two arguments."],"tags":["pebble","encryption","validation","missing-argument","encrypt"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}