{"record":{"id":"c89f2e5951c479bf","repo":"kestra-io/kestra","slug":"the-decrypt-function-expects-two-arguments-key","errorCode":null,"errorMessage":"The 'decrypt' function expects two arguments 'key' and 'encrypted'.","messagePattern":"The 'decrypt' function expects two arguments 'key' and 'encrypted'\\.","errorType":"validation","errorClass":"PebbleException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/pebble/functions/DecryptFunction.java","lineNumber":32,"sourceCode":"    public static final String NAME = \"decrypt\";\n\n    @Override\n    public List<String> getArgumentNames() {\n        return List.of(\"key\", \"encrypted\");\n    }\n\n    @Override\n    public Map<String, String> getArgumentDefaults() {\n        return Map.of(\n            \"key\", SecretFunction.NAME + \"('encryption_key')\",\n            \"encrypted\", \"outputs.request.encryptedBody\"\n        );\n    }\n\n    @Override\n    public Object execute(Map<String, Object> args, PebbleTemplate self, EvaluationContext context, int lineNumber) {\n        if (!args.containsKey(\"key\") || !args.containsKey(\"encrypted\")) {\n            throw new PebbleException(null, \"The 'decrypt' function expects two arguments 'key' and 'encrypted'.\", lineNumber, self.getName());\n        }\n\n        String key = (String) args.get(\"key\");\n        String encrypted = (String) args.get(\"encrypted\");\n        try {\n            return EncryptionService.decrypt(key, encrypted);\n        } catch (GeneralSecurityException e) {\n            throw new PebbleException(e, e.getMessage(), lineNumber, self.getName());\n        }\n    }\n}\n","sourceCodeStart":14,"sourceCodeEnd":44,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/pebble/functions/DecryptFunction.java#L14-L44","documentation":"The decrypt() function decrypts a value with AES/GCM using a key retrieved (typically) via the secret() function. It throws when args lacks 'key' or 'encrypted'. Defaults are provided for autocompletion (key=secret('encryption_key'), encrypted=outputs.request.encryptedBody) but those defaults are only expressions — at runtime both must resolve to non-absent entries.","triggerScenarios":"Calling {{ decrypt() }} with neither argument, or omitting one of the two ({{ decrypt(key=secret('encryption_key')) }} without encrypted). Also when the bound secret/output is absent so the argument is not present in args.","commonSituations":"Forgetting the encrypted payload argument; the secret 'encryption_key' not defined so key resolves absent; refactoring outputs and renaming the field that feeds 'encrypted'.","solutions":["Provide both arguments: {{ decrypt(key=secret('encryption_key'), encrypted=outputs.request.encryptedBody) }}.","Ensure the 'encryption_key' secret exists in the namespace and the encrypted output is produced.","Verify the key and encrypted values are strings; non-string casts later cause ClassCastException."],"exampleFix":"// before\n{{ decrypt(encrypted=outputs.body.encryptedText) }}\n// after\n{{ decrypt(key=secret('encryption_key'), encrypted=outputs.body.encryptedText) }}","handlingStrategy":"validation","validationCode":"// Provide both arguments; ensure secret and output exist\n{{ decrypt(key=secret('encryption_key'), encrypted=outputs.request.encryptedBody) }}","typeGuard":"// Java: confirm both args are present and are strings\nif (!args.containsKey(\"key\") || !args.containsKey(\"encrypted\")) {\n    throw new IllegalArgumentException(\"decrypt needs 'key' and 'encrypted'\");\n}\nif (!(args.get(\"key\") instanceof String) || !(args.get(\"encrypted\") instanceof String)) {\n    throw new IllegalArgumentException(\"decrypt 'key' and 'encrypted' must be strings\");\n}","tryCatchPattern":null,"preventionTips":["Always pass both key and encrypted explicitly.","Confirm the 'encryption_key' secret exists in the namespace.","Ensure the upstream task produced the encrypted output field."],"tags":["pebble","function","argument","encryption","secret"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}