js-client-side-field-level-encryption.txt

==========================================
Client-Side Field Level Encryption Methods
==========================================

.. default-domain:: mongodb

.. contents:: On this page
   :local:
   :backlinks: none
   :depth: 1
   :class: singlecol

.. include:: /includes/extracts/methods-toc-explanation.rst

.. include:: /includes/extracts/csfle-requires-enabling-encryption.rst

The following methods are for :binary:`~bin.mongosh`
*only*. For instructions on implementing client-side field level
encryption using a MongoDB driver, defer to the driver documentation. See 
:ref:`csfle-driver-compatibility` for a complete list of drivers with support 
for client-side field level encryption.

.. list-table::
   :widths: 30,70
   :header-rows: 1

   * - Name
     - Description

   * - :method:`getKeyVault()`
     - Returns the key vault object for the current MongoDB connection.

   * - :method:`KeyVault.createKey()`
     - Creates a data encryption key for use with client-side field level encryption.

   * - :method:`KeyVault.deleteKey()`
     - Deletes the specified data encryption key from the key vault.

   * - :method:`KeyVault.getKey()`
     - Retreives the specified data encryption key from the key vault.

   * - :method:`KeyVault.getKeys()`
     - Retrieves all keys in the key vault.

   * - :method:`KeyVault.addKeyAlternateName()`
     - Associates a key alternative name to the specified data encryption key.

   * - :method:`KeyVault.removeKeyAlternateName()`
     - Removes a key alternative name from the specified data encryption key.

   * - :method:`KeyVault.rewrapManyDataKey()`
     - Decrypts multiple data keys and re-encrypts them with a new master key.

   * - :method:`KeyVault.getKeyByAltName()`
     - Retrieves keys with the specified key alternative name.

   * - :method:`getClientEncryption()`
     - Returns the client encryption object for supporting explicit encryption/decryption of fields.

   * - :method:`ClientEncryption.createEncryptedCollection()`
     - Creates a collection with encrypted fields.

   * - :method:`ClientEncryption.encrypt()`
     - Encrypts a field using a specified data encryption key and encryption algorithm.

   * - :method:`ClientEncryption.decrypt()`
     - Decrypts a field using the associated data encryption key and encryption algorithm.


.. toctree::
   :titlesonly: 
   :hidden: 

   ClientEncryption.createEncryptedCollection </reference/method/ClientEncryption.createEncryptedCollection>
   ClientEncryption.encrypt </reference/method/ClientEncryption.encrypt>
   ClientEncryption.decrypt </reference/method/ClientEncryption.decrypt>
   getClientEncryption </reference/method/getClientEncryption>
   getKeyVault </reference/method/getKeyVault>
   KeyVault.addKeyName </reference/method/KeyVault.addKeyName>
   KeyVault.addKeyAlternateName </reference/method/KeyVault.addKeyAlternateName>
   KeyVault.createDataKey </reference/method/KeyVault.createDataKey>
   KeyVault.createKey </reference/method/KeyVault.createKey>
   KeyVault.deleteKey </reference/method/KeyVault.deleteKey>
   KeyVault.getKey </reference/method/KeyVault.getKey>
   KeyVault.getKeys </reference/method/KeyVault.getKeys>
   KeyVault.getKeyByAltName </reference/method/KeyVault.getKeyByAltName>
   KeyVault.removeKeyAlternateName </reference/method/KeyVault.removeKeyAlternateName>
   KeyVault.removeKeyAltName </reference/method/KeyVault.removeKeyAltName>
   KeyVault.rewrapManyDataKey </reference/method/KeyVault.rewrapManyDataKey>