'json' parameter is not valid after updating secret key in ADF web activity

Question

'json' parameter is not valid after updating secret key in ADF web activity

Anneka Osmun 0

Hello,

We have a pipeline with two web activities:

The first retrieves a secret key from the key vault.
The second uses that secret key to obtain a bearer token.

Recently, we updated the expired secret key retrieved in the first web activity. The only change we made was updating the URL to fetch the new secret key from the key vault, everything else about the web activity remained the same.

However, the second web activity, which uses the secret key to get a bearer token, is now failing with the following error:

Error: The function 'json' parameter is not valid. The provided value 'examplesecretkey' cannot be parsed: 'Unexpected character encountered while parsing value: x. Path '', line 0, position 0

Since the only change was updating the link to the new secret key in the key vault, why is the second web activity unable to process it?

1 answer

Your answer

Answer 1

J N S S Kasyap 3,300 Microsoft External Staff Moderator

Hi @Anneka Osmun

The error message indicates that the json function in ADF is being used in the second web activity to interpret the output of the first web activity (the secret key). The json function expects a valid JSON string, such as {"key": "examplesecretkey"}, but it’s receiving something it can’t parse likely a plain string like examplesecretkey resulting in the parsing failure

The second web activity is likely using an expression like @json(activity('FirstWebActivity').output) to parse the output of the first activity, expecting a JSON object (e.g., {"value": "examplesecretkey"}). However, if the first activity’s output is now returning the secret key as a plain string (examplesecretkey) instead of a JSON structure, the json() function will fail because it can’t parse a non-JSON string.

The possible below scenarios:

If the first activity’s output is a JSON object with a value property (e.g., {"value": "examplesecretkey"}), update the second activity to reference it correctly

@activity('FirstWebActivity').output.value

If the output is a plain string, remove the json() function from the expression in the second activity.

@activity('FirstWebActivity').output

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-03-21T18:45:50.8633333+00:00

@Anneka Osmun
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-03-24T18:48:58.9233333+00:00

@Anneka Osmun
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Anneka Osmun 0 Reputation points

2025-03-24T18:56:13.43+00:00

Hello,

I tried the two suggestions above but both did not work. The issue is very strange because it was working before the secret key expired. We only change the URL to the secret key, and nothing else. Did something change within the key vault so that the activity would not recognize the JSON file?

Thank you for your help.
J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-03-24T21:47:53.2366667+00:00

@Anneka Osmun

I understand how challenging this situation can be, Here are a few steps that might help resolve the issue:

The updated URL might not be pointing to the correct Key Vault endpoint or might include an unintended parameter that alters the response. For example, if the URL lacks the proper API version (?api-version=7.3) or points to a different resource, the response format could change
Double-check the updated URL in the first web activity. Ensure no extra query parameters or typos were introduced.

Verify the first web activity’s settings ensure it’s a GET request with proper authentication (e.g., Managed Identity or a secret-based token) and no unexpected body or headers overriding the default behavior

When the secret expired and was updated, it’s possible the new secret was created or configured differently in Key Vault. Ensure it hasn’t been altered in a way that affects the API response.

I hope this information helps. Please do let us know if you have any further queries.
J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-03-25T19:22:01.59+00:00

@Anneka Osmun
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Anneka Osmun 0 Reputation points

2025-03-27T13:32:45.64+00:00

Hello, thank you for your response. How do you know the correct API version?
J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-03-27T20:39:52.65+00:00

@Anneka Osmun
The correct API version for accessing Azure Key Vault depends on the version supported by the service at the time of your request and the features you need. Since your pipeline was working before the secret key expired and you only changed the URL, the issue likely isn’t about picking a "new" API version but ensuring the updated URL aligns with what was previously working.

Azure Key Vault’s REST API evolves over time, with versions like 7.0, 7.1, 7.2, 7.3, and more recent ones (e.g., 7.4 as of 2025) being available. Typically, the API version is specified in the URL query parameter, such as ?api-version=7.3.

Since your pipeline worked before, the original URL in the first web activity likely included the correct API version. Compare the old URL (before the change) with the new one. If the original had something like ?api-version=7.3 and the new one doesn’t, re-add it to match.

Microsoft’s official Azure Key Vault REST API documentation lists supported versions. As of March 27, 2025, 7.3 is a stable, widely used version, but 7.4 or later might be available. If you don’t know the original version, 7.3 is a safe default to try unless your Key Vault requires a newer feature.

Revert to the exact structure of the original URL, just swapping in the new secret’s name or path, and ensure the api-version parameter is included. Then, validate the first activity’s output in ADF to confirm it’s still a JSON object (e.g., {"value": "examplesecretkey"}). If it’s not, the problem might be in Key Vault’s configuration or permissions rather than the API version.

I hope this information helps. Please do let us know if you have any further queries.
J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-03-28T18:22:05.6133333+00:00

@Anneka Osmun
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Shaik Sadiq Basha (MINDTREE LIMITED) 0 Reputation points Microsoft External Staff

2025-06-07T22:34:42.7533333+00:00

Hello @J N S S Kasyap ,
Customer responded as below to your above suggestion could you please check and help on the issue?

When I originally changed the URL for the key vault, I didn’t change the API version. Since opening this ticket, I have tried 7.0 and 7.3 and both work to run the original web activity. However, the issue occurs in the second web activity, for some reason it can’t read the JSON file that is output from the first web activity no matter which API version I use in the first web activity.

Looking forward to your response.
Shaik Sadiq Basha (MINDTREE LIMITED) 0 Reputation points Microsoft External Staff

2025-06-09T22:40:17.48+00:00

Hello @J N S S Kasyap , could you please help on the issue?
Looking forward to your response.
J N S S Kasyap 3,300 Reputation points Microsoft External Staff Moderator

2025-06-11T16:11:25.4666667+00:00
@Shaik Sadiq Basha (MINDTREE LIMITED)

If the second Web Activity fails to read the output from the first, even after confirming the API version works (7.0 or 7.3), it's likely that the first Web Activity is returning a raw string instead of a JSON object. This typically happens if the Key Vault URL points to the secrets/<name>/value endpoint instead of secrets/<name>?api-version=7.3.

To fix it:
Ensure the first Web Activity calls this endpoint format:

https://<keyvault-name>.vault.azure.net/secrets/<secret-name>?api-version=7.3

Then, in the second Web Activity, access the value like this:

@activity('FirstWebActivity').output.value

Avoid using the json() function unless the output is a full JSON string. Always inspect the actual output of the first activity (under the Output tab) to confirm its structure.
Shaik Sadiq Basha (MINDTREE LIMITED) 0 Reputation points Microsoft External Staff

2025-06-13T17:50:25.4566667+00:00

Hello @J N S S Kasyap
Customer responded as below could you please check and help:

I’ve checked the pipeline, and I believe it has everything you mentioned already.

The first web activity has the correct endpoint format.

Your example:

Our web activity:

I’ve also used api-version 7.3, and it doesn’t change anything. The pipeline still fails.

The output of the first web activity is a json file. It looks like this:

In the second web activity, although the code is bit more complicated than yours, it does follow the format of your suggestion below with use of the json() function (since the output appears to be a json file).

Yours:

Our web activity:

I have tried removing the json() functions and the pipeline won’t run that way either.

Share via

'json' parameter is not valid after updating secret key in ADF web activity

1 answer

Your answer