elsa-workflows/elsa-core · error · InvalidOperationException

Secret ' ' is not active.

Error message

Secret '{secret.Name}' is not active.

What it means

GetLatestActiveVersion checks the secret's Status and throws InvalidOperationException when it is not SecretStatus.Active. The manager refuses to resolve a value from a secret whose overall lifecycle state is disabled/archived. This protects callers from reading secrets that were intentionally taken out of service.

Solutions

1. Re-activate the secret (set Status back to Active) if it should be readable.
2. Point the reference at a different, active secret.
3. If the disable was accidental, fix the status through the secrets management API and retry.
4. Confirm which secret status was set and why (audit/rotation policy) before re-enabling.

Example fix

// before
var value = await resolver.ResolveAsync(new SecretReference("OldApiKey")); // secret Disabled
// after
var secret = await secretManager.GetAsync("OldApiKey");
if (secret?.Status != SecretStatus.Active)
    await secretManager.UpdateAsync(... set Status = SecretStatus.Active ...); // or use an active secret
var value = await resolver.ResolveAsync(new SecretReference("OldApiKey"));

var secret = await secretManager.GetAsync(name, ct);
if (secret is not { Status: SecretStatus.Active })
    throw new InvalidOperationException($"Secret '{name}' is not active (status: {secret?.Status}).");

bool IsUsable(Secret? s) => s is { Status: SecretStatus.Active };

try { var value = await resolver.ResolveAsync(reference, ct); }
catch (InvalidOperationException ex) when (ex.Message.Contains("is not active")) { logger.LogError("Secret {Name} disabled; re-activate or use alternative", reference.Name); throw; }

When it happens

Trigger: Resolving or rotating a secret whose Secret.Status is anything other than Active (e.g. Disabled), through paths that call GetLatestActiveVersion.

Common situations: Secret was disabled by an admin pending rotation; secret archived during cleanup; copy/paste of a secret name pointing at a deprecated secret; environment where secrets are toggled off via status flags.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• Secret ' ' is revoked and cannot be rotated.
• BPMN element ' ' binds process activity ' ' as the work of…
• The secret field name must contain a letter or digit.
• Only managed secret bindings can remove managed secret…
• The configured secret binding could not be resolved.

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/9c0723ff376a1336. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs:205

        };

        var version = new SecretVersion { Version = 1, ExpiresAt = request.ExpiresAt };
        version.Payload = await store.WriteAsync(secret, version, CreatePayload(request), cancellationToken);
        secret.Versions.Add(version);

        return secret;
    }

    private async Task<Secret> GetExistingAsync(string name, CancellationToken cancellationToken)
    {
        var secret = await GetAsync(name, cancellationToken);
        return secret == null ? throw new KeyNotFoundException($"Secret '{name}' was not found.") : secret;
    }

    private static SecretVersion GetLatestActiveVersion(Secret secret)
    {
        if (secret.Status != SecretStatus.Active)
            throw new InvalidOperationException($"Secret '{secret.Name}' is not active.");

        return secret.LatestActiveVersion ?? throw new InvalidOperationException($"Secret '{secret.Name}' has no active version.");
    }

    private void ValidateName(string name)
    {
        if (!nameValidator.IsValid(name, out var error))
            throw new InvalidOperationException(error);
    }

    private static void EnsureCanWrite(ISecretStore store)
    {
        if (!store.Descriptor.Capabilities.HasFlag(SecretStoreCapabilities.Write))
            throw new InvalidOperationException($"Secret store '{store.Name}' does not support writing secrets.");
    }

    private static IEnumerable<Secret> ApplyFilters(IEnumerable<Secret> secrets, ListSecretsRequest request)
    {

View on GitHub (pinned to fe9217bdfa)