{"record":{"id":"9c0723ff376a1336","repo":"elsa-workflows/elsa-core","slug":"secret-secret-name-is-not-active","errorCode":null,"errorMessage":"Secret '{secret.Name}' is not active.","messagePattern":"Secret '(.+?)' is not active\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs","lineNumber":205,"sourceCode":"        };\n\n        var version = new SecretVersion { Version = 1, ExpiresAt = request.ExpiresAt };\n        version.Payload = await store.WriteAsync(secret, version, CreatePayload(request), cancellationToken);\n        secret.Versions.Add(version);\n\n        return secret;\n    }\n\n    private async Task<Secret> GetExistingAsync(string name, CancellationToken cancellationToken)\n    {\n        var secret = await GetAsync(name, cancellationToken);\n        return secret == null ? throw new KeyNotFoundException($\"Secret '{name}' was not found.\") : secret;\n    }\n\n    private static SecretVersion GetLatestActiveVersion(Secret secret)\n    {\n        if (secret.Status != SecretStatus.Active)\n            throw new InvalidOperationException($\"Secret '{secret.Name}' is not active.\");\n\n        return secret.LatestActiveVersion ?? throw new InvalidOperationException($\"Secret '{secret.Name}' has no active version.\");\n    }\n\n    private void ValidateName(string name)\n    {\n        if (!nameValidator.IsValid(name, out var error))\n            throw new InvalidOperationException(error);\n    }\n\n    private static void EnsureCanWrite(ISecretStore store)\n    {\n        if (!store.Descriptor.Capabilities.HasFlag(SecretStoreCapabilities.Write))\n            throw new InvalidOperationException($\"Secret store '{store.Name}' does not support writing secrets.\");\n    }\n\n    private static IEnumerable<Secret> ApplyFilters(IEnumerable<Secret> secrets, ListSecretsRequest request)\n    {","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs#L187-L223","documentation":"GetLatestActiveVersion checks the secret's Status and throws InvalidOperationException when it is not SecretStatus.Active. The manager refuses to resolve a value from a secret whose overall lifecycle state is disabled/archived. This protects callers from reading secrets that were intentionally taken out of service.","triggerScenarios":"Resolving or rotating a secret whose Secret.Status is anything other than Active (e.g. Disabled), through paths that call GetLatestActiveVersion.","commonSituations":"Secret was disabled by an admin pending rotation; secret archived during cleanup; copy/paste of a secret name pointing at a deprecated secret; environment where secrets are toggled off via status flags.","solutions":["Re-activate the secret (set Status back to Active) if it should be readable.","Point the reference at a different, active secret.","If the disable was accidental, fix the status through the secrets management API and retry.","Confirm which secret status was set and why (audit/rotation policy) before re-enabling."],"exampleFix":"// before\nvar value = await resolver.ResolveAsync(new SecretReference(\"OldApiKey\")); // secret Disabled\n// after\nvar secret = await secretManager.GetAsync(\"OldApiKey\");\nif (secret?.Status != SecretStatus.Active)\n    await secretManager.UpdateAsync(... set Status = SecretStatus.Active ...); // or use an active secret\nvar value = await resolver.ResolveAsync(new SecretReference(\"OldApiKey\"));","handlingStrategy":"validation","validationCode":"var secret = await secretManager.GetAsync(name, ct);\nif (secret is not { Status: SecretStatus.Active })\n    throw new InvalidOperationException($\"Secret '{name}' is not active (status: {secret?.Status}).\");","typeGuard":"bool IsUsable(Secret? s) => s is { Status: SecretStatus.Active };","tryCatchPattern":"try { var value = await resolver.ResolveAsync(reference, ct); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"is not active\")) { logger.LogError(\"Secret {Name} disabled; re-activate or use alternative\", reference.Name); throw; }","preventionTips":["Track secret status in ops dashboards and alert on Disabled secrets","Document disable/enable procedures so secrets are re-enabled after rotation freezes","Check status before building SecretReferences at runtime"],"tags":["secrets","invalid-state","secret-status"],"backgroundTag":"invalid-state-transition","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}