An internal class to be used by the driver for auto encryption\nNOTE: Not meant to be instantiated directly, this is for internal use only.
\nThe public interface for explicit in-use encryption
\nAn error indicating that something went wrong specifically with MongoDB Client Encryption
\nAn error indicating that ClientEncryption.createEncryptedCollection() failed to create data keys
An error indicating that ClientEncryption.createEncryptedCollection() failed to create a collection
An error indicating that mongodb-client-encryption failed to auto-refresh Azure KMS credentials.
\n*any serializable BSON value
\nBSON.LongA 64 bit integer, represented by the js-bson Long type.
\nobjectConfiguration options that are used by specific KMS providers during key generation, encryption, and decryption.
\nobjectA data key as stored in the database.
\nstringA string containing the name of a kms provider. Valid options are 'aws', 'azure', 'gcp', 'kmip', or 'local'
\nobjectThe ClientSession class from the MongoDB Node driver (see https://mongodb.github.io/node-mongodb-native/4.8/classes/ClientSession.html)
\nobjectThe result of a delete operation from the MongoDB Node driver (see https://mongodb.github.io/node-mongodb-native/4.8/interfaces/DeleteResult.html)
\nobjectThe BulkWriteResult class from the MongoDB Node driver (https://mongodb.github.io/node-mongodb-native/4.8/classes/BulkWriteResult.html)
\nobjectThe FindCursor class from the MongoDB Node driver (see https://mongodb.github.io/node-mongodb-native/4.8/classes/FindCursor.html)
\nBinaryThe id of an existing dataKey. Is a bson Binary value.\nCan be used for ClientEncryption.encrypt, and can be used to directly\nquery for the data key itself against the key vault namespace.
\nfunctionobjectConfiguration options for making an AWS encryption key
\nobjectConfiguration options for making a GCP encryption key
\nobjectConfiguration options for making an Azure encryption key
\nobjectfunctionobjectmin, max, sparsity, and range must match the values set in the encryptedFields of the destination collection.\nFor double and decimal128, min/max/precision must all be set, or all be unset.
\nobjectOptions to provide when encrypting data.
\nMongoClient | The client autoEncryption is enabled on |\n| [options] | [AutoEncryptionOptions](#AutoEncrypter..AutoEncryptionOptions) | Optional settings |\n\nCreate an AutoEncrypter\n\n**Note**: Do not instantiate this class directly. Rather, supply the relevant options to a MongoClient\n\n**Note**: Supplying `options.schemaMap` provides more security than relying on JSON Schemas obtained from the server.\nIt protects against a malicious server advertising a false JSON Schema, which could trick the client into sending unencrypted data that should be encrypted.\nSchemas supplied in the schemaMap only apply to configuring automatic encryption for Client-Side Field Level Encryption.\nOther validation rules in the JSON schema will not be enforced by the driver and will result in an error.\n\n**Example** \n```js\n// Enabling autoEncryption via a MongoClient\nconst { MongoClient } = require('mongodb');\nconst client = new MongoClient(URL, {\n autoEncryption: {\n kmsProviders: {\n aws: {\n accessKeyId: AWS_ACCESS_KEY,\n secretAccessKey: AWS_SECRET_KEY\n }\n }\n }\n});\n\nawait client.connect();\n// From here on, the client will be encrypting / decrypting automatically\n```\n\n\n### *autoEncrypter*.cryptSharedLibVersionInfo\nReturn the current libmongocrypt's CSFLE shared library version\nas `{ version: bigint, versionStr: string }`, or `null` if no CSFLE\nshared library was loaded.\n\n\n\n### *autoEncrypter*.askForKMSCredentials()\nAsk the user for KMS credentials.\n\nThis returns anything that looks like the kmsProviders original input\noption. It can be empty, and any provider specified here will override\nthe original ones.\n\n\n\n### *AutoEncrypter*~logLevel\nThe level of severity of the log message\n\n| Value | Level |\n|-------|-------|\n| 0 | Fatal Error |\n| 1 | Error |\n| 2 | Warning |\n| 3 | Info |\n| 4 | Trace |\n\n\n\n### *AutoEncrypter*~AutoEncryptionOptions\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| [keyVaultClient] | MongoClient | A `MongoClient` used to fetch keys from a key vault |\n| [keyVaultNamespace] | string | The namespace where keys are stored in the key vault |\n| [kmsProviders] | [KMSProviders](#KMSProviders) | Configuration options that are used by specific KMS providers during key generation, encryption, and decryption. |\n| [schemaMap] | object | A map of namespaces to a local JSON schema for encryption |\n| [bypassAutoEncryption] | boolean | Allows the user to bypass auto encryption, maintaining implicit decryption |\n| [options.logger] | [logger](#AutoEncrypter..logger) | An optional hook to catch logging messages from the underlying encryption engine |\n| [extraOptions] | [AutoEncryptionExtraOptions](#AutoEncrypter..AutoEncryptionExtraOptions) | Extra options related to the mongocryptd process |\n\nConfiguration options for a automatic client encryption.\n\n\n\n### *AutoEncrypter*~AutoEncryptionExtraOptions\n**Properties**\n\n| Name | Type | Default | Description |\n| --- | --- | --- | --- |\n| [mongocryptdURI] | string | | A local process the driver communicates with to determine how to encrypt values in a command. Defaults to \"mongodb://%2Fvar%2Fmongocryptd.sock\" if domain sockets are available or \"mongodb://localhost:27020\" otherwise |\n| [mongocryptdBypassSpawn] | boolean | false | If true, autoEncryption will not attempt to spawn a mongocryptd before connecting |\n| [mongocryptdSpawnPath] | string | | The path to the mongocryptd executable on the system |\n| [mongocryptdSpawnArgs] | Array.<string> | | Command line arguments to use when auto-spawning a mongocryptd |\n\nExtra options related to the mongocryptd process\n\n\n\n### *AutoEncrypter*~logger\n\n| Param | Type | Description |\n| --- | --- | --- |\n| level | [logLevel](#AutoEncrypter..logLevel) | The level of logging. |\n| message | string | The message to log |\n\nA callback that is invoked with logging information from\nthe underlying C++ Bindings.\n\n\n\n## ClientEncryption\nThe public interface for explicit in-use encryption\n\n\n* [ClientEncryption](#ClientEncryption)\n\n * [new ClientEncryption(client, options)](#new_ClientEncryption_new)\n\n * _instance_\n * [.createDataKey(provider, [options], [callback])](#ClientEncryption+createDataKey)\n\n * [.rewrapManyDataKey(filter, [options])](#ClientEncryption+rewrapManyDataKey)\n\n * [.deleteKey(_id)](#ClientEncryption+deleteKey)\n\n * [.getKeys()](#ClientEncryption+getKeys)\n\n * [.getKey(_id)](#ClientEncryption+getKey)\n\n * [.getKeyByAltName(keyAltName)](#ClientEncryption+getKeyByAltName)\n\n * [.addKeyAltName(_id, keyAltName)](#ClientEncryption+addKeyAltName)\n\n * [.removeKeyAltName(_id, keyAltName)](#ClientEncryption+removeKeyAltName)\n\n * [.createEncryptedCollection(db, name, options)](#ClientEncryption+createEncryptedCollection)\n\n * [.encrypt(value, options, [callback])](#ClientEncryption+encrypt)\n\n * [.encryptExpression(expression, options)](#ClientEncryption+encryptExpression)\n\n * [.decrypt(value, callback)](#ClientEncryption+decrypt)\n\n * [.askForKMSCredentials()](#ClientEncryption+askForKMSCredentials)\n\n * _inner_\n * [~decryptCallback](#ClientEncryption..decryptCallback)\n\n\n\n\n### new ClientEncryption(client, options)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| client | MongoClient | The client used for encryption |\n| options | object | Additional settings |\n| options.keyVaultNamespace | string | The namespace of the key vault, used to store encryption keys |\n| options.tlsOptions | object | An object that maps KMS provider names to TLS options. |\n| [options.keyVaultClient] | MongoClient | A `MongoClient` used to fetch keys from a key vault. Defaults to `client` |\n| [options.kmsProviders] | [KMSProviders](#KMSProviders) | options for specific KMS providers to use |\n\nCreate a new encryption instance\n\n**Example** \n```js\nnew ClientEncryption(mongoClient, {\n keyVaultNamespace: 'client.encryption',\n kmsProviders: {\n local: {\n key: masterKey // The master key used for encryption/decryption. A 96-byte long Buffer\n }\n }\n});\n```\n**Example** \n```js\nnew ClientEncryption(mongoClient, {\n keyVaultNamespace: 'client.encryption',\n kmsProviders: {\n aws: {\n accessKeyId: AWS_ACCESS_KEY,\n secretAccessKey: AWS_SECRET_KEY\n }\n }\n});\n```\n\n\n### *clientEncryption*.createDataKey(provider, [options], [callback])\n\n| Param | Type | Description |\n| --- | --- | --- |\n| provider | string | The KMS provider used for this data key. Must be `'aws'`, `'azure'`, `'gcp'`, or `'local'` |\n| [options] | object | Options for creating the data key |\n| [options.masterKey] | [AWSEncryptionKeyOptions](#AWSEncryptionKeyOptions) \\| [AzureEncryptionKeyOptions](#AzureEncryptionKeyOptions) \\| [GCPEncryptionKeyOptions](#GCPEncryptionKeyOptions) | Idenfities a new KMS-specific key used to encrypt the new data key |\n| [options.keyAltNames] | Array.<string> | An optional list of string alternate names used to reference a key. If a key is created with alternate names, then encryption may refer to the key by the unique alternate name instead of by _id. |\n| [callback] | [ClientEncryptionCreateDataKeyCallback](#ClientEncryptionCreateDataKeyCallback) | Optional callback to invoke when key is created |\n\nCreates a data key used for explicit encryption and inserts it into the key vault namespace\n\n**Returns**: Promise \\| void - If no callback is provided, returns a Promise that either resolves with [the id of the created data key](ClientEncryption~dataKeyId), or rejects with an error. If a callback is provided, returns nothing. \n**Example** \n```js\n// Using callbacks to create a local key\nclientEncryption.createDataKey('local', (err, dataKey) => {\n if (err) {\n // This means creating the key failed.\n } else {\n // key creation succeeded\n }\n});\n```\n**Example** \n```js\n// Using async/await to create a local key\nconst dataKeyId = await clientEncryption.createDataKey('local');\n```\n**Example** \n```js\n// Using async/await to create an aws key\nconst dataKeyId = await clientEncryption.createDataKey('aws', {\n masterKey: {\n region: 'us-east-1',\n key: 'xxxxxxxxxxxxxx' // CMK ARN here\n }\n});\n```\n**Example** \n```js\n// Using async/await to create an aws key with a keyAltName\nconst dataKeyId = await clientEncryption.createDataKey('aws', {\n masterKey: {\n region: 'us-east-1',\n key: 'xxxxxxxxxxxxxx' // CMK ARN here\n },\n keyAltNames: [ 'mySpecialKey' ]\n});\n```\n\n\n### *clientEncryption*.rewrapManyDataKey(filter, [options])\n\n| Param | Type | Description |\n| --- | --- | --- |\n| filter | object | A valid MongoDB filter. Any documents matching this filter will be re-wrapped. |\n| [options] | object | |\n| options.provider | [KmsProvider](#KmsProvider) | The KMS provider to use when re-wrapping the data keys. |\n| [options.masterKey] | [AWSEncryptionKeyOptions](#AWSEncryptionKeyOptions) \\| [AzureEncryptionKeyOptions](#AzureEncryptionKeyOptions) \\| [GCPEncryptionKeyOptions](#GCPEncryptionKeyOptions) | |\n\nSearches the keyvault for any data keys matching the provided filter. If there are matches, rewrapManyDataKey then attempts to re-wrap the data keys using the provided options.\n\nIf no matches are found, then no bulk write is performed.\n\n**Example** \n```js\n// rewrapping all data data keys (using a filter that matches all documents)\nconst filter = {};\n\nconst result = await clientEncryption.rewrapManyDataKey(filter);\nif (result.bulkWriteResult != null) {\n // keys were re-wrapped, results will be available in the bulkWrite object.\n}\n```\n**Example** \n```js\n// attempting to rewrap all data keys with no matches\nconst filter = { _id: new Binary() } // assume _id matches no documents in the database\nconst result = await clientEncryption.rewrapManyDataKey(filter);\n\nif (result.bulkWriteResult == null) {\n // no keys matched, `bulkWriteResult` does not exist on the result object\n}\n```\n\n\n### *clientEncryption*.deleteKey(_id)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| _id | [ClientEncryptionDataKeyId](#ClientEncryptionDataKeyId) | the id of the document to delete. |\n\nDeletes the key with the provided id from the keyvault, if it exists.\n\n**Returns**: [Promise.<DeleteResult>](#DeleteResult) - Returns a promise that either resolves to a [DeleteResult](#DeleteResult) or rejects with an error. \n**Example** \n```js\n// delete a key by _id\nconst id = new Binary(); // id is a bson binary subtype 4 object\nconst { deletedCount } = await clientEncryption.deleteKey(id);\n\nif (deletedCount != null && deletedCount > 0) {\n // successful deletion\n}\n```\n\n\n### *clientEncryption*.getKeys()\nFinds all the keys currently stored in the keyvault.\n\nThis method will not throw.\n\n**Returns**: [FindCursor](#FindCursor) - a FindCursor over all keys in the keyvault. \n**Example** \n```js\n// fetching all keys\nconst keys = await clientEncryption.getKeys().toArray();\n```\n\n\n### *clientEncryption*.getKey(_id)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| _id | [ClientEncryptionDataKeyId](#ClientEncryptionDataKeyId) | the id of the document to delete. |\n\nFinds a key in the keyvault with the specified _id.\n\n**Returns**: [Promise.<DataKey>](#DataKey) - Returns a promise that either resolves to a [DataKey](#DataKey) if a document matches the key or null if no documents\nmatch the id. The promise rejects with an error if an error is thrown. \n**Example** \n```js\n// getting a key by id\nconst id = new Binary(); // id is a bson binary subtype 4 object\nconst key = await clientEncryption.getKey(id);\nif (!key) {\n // key is null if there was no matching key\n}\n```\n\n\n### *clientEncryption*.getKeyByAltName(keyAltName)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| keyAltName | string | a keyAltName to search for a key |\n\nFinds a key in the keyvault which has the specified keyAltName.\n\n**Returns**: Promise.<(DataKey\\|null)> - Returns a promise that either resolves to a [DataKey](#DataKey) if a document matches the key or null if no documents\nmatch the keyAltName. The promise rejects with an error if an error is thrown. \n**Example** \n```js\n// get a key by alt name\nconst keyAltName = 'keyAltName';\nconst key = await clientEncryption.getKeyByAltName(keyAltName);\nif (!key) {\n // key is null if there is no matching key\n}\n```\n\n\n### *clientEncryption*.addKeyAltName(_id, keyAltName)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| _id | [ClientEncryptionDataKeyId](#ClientEncryptionDataKeyId) | The id of the document to update. |\n| keyAltName | string | a keyAltName to search for a key |\n\nAdds a keyAltName to a key identified by the provided _id.\n\nThis method resolves to/returns the *old* key value (prior to adding the new altKeyName).\n\n**Returns**: [Promise.<DataKey>](#DataKey) - Returns a promise that either resolves to a [DataKey](#DataKey) if a document matches the key or null if no documents\nmatch the id. The promise rejects with an error if an error is thrown. \n**Example** \n```js\n// adding an keyAltName to a data key\nconst id = new Binary(); // id is a bson binary subtype 4 object\nconst keyAltName = 'keyAltName';\nconst oldKey = await clientEncryption.addKeyAltName(id, keyAltName);\nif (!oldKey) {\n // null is returned if there is no matching document with an id matching the supplied id\n}\n```\n\n\n### *clientEncryption*.removeKeyAltName(_id, keyAltName)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| _id | [ClientEncryptionDataKeyId](#ClientEncryptionDataKeyId) | The id of the document to update. |\n| keyAltName | string | a keyAltName to search for a key |\n\nAdds a keyAltName to a key identified by the provided _id.\n\nThis method resolves to/returns the *old* key value (prior to removing the new altKeyName).\n\nIf the removed keyAltName is the last keyAltName for that key, the `altKeyNames` property is unset from the document.\n\n**Returns**: Promise.<(DataKey\\|null)> - Returns a promise that either resolves to a [DataKey](#DataKey) if a document matches the key or null if no documents\nmatch the id. The promise rejects with an error if an error is thrown. \n**Example** \n```js\n// removing a key alt name from a data key\nconst id = new Binary(); // id is a bson binary subtype 4 object\nconst keyAltName = 'keyAltName';\nconst oldKey = await clientEncryption.removeKeyAltName(id, keyAltName);\n\nif (!oldKey) {\n // null is returned if there is no matching document with an id matching the supplied id\n}\n```\n\n\n### *clientEncryption*.createEncryptedCollection(db, name, options)\n**Throws**:\n\n- [MongoCryptCreateDataKeyError](#MongoCryptCreateDataKeyError) - If part way through the process a createDataKey invocation fails, an error will be rejected that has the partial `encryptedFields` that were created.\n- [MongoCryptCreateEncryptedCollectionError](#MongoCryptCreateEncryptedCollectionError) - If creating the collection fails, an error will be rejected that has the entire `encryptedFields` that were created.\n\n**Experimental**: Public Technical Preview\n\nA convenience method for creating an encrypted collection.\nThis method will create data keys for any encryptedFields that do not have a `keyId` defined\nand then create a new collection with the full set of encryptedFields. \n\n| Param | Type | Description |\n| --- | --- | --- |\n| db | Db | A Node.js driver Db object with which to create the collection |\n| name | string | The name of the collection to be created |\n| options | object | Options for createDataKey and for createCollection |\n| options.provider | string | KMS provider name |\n| [options.masterKey] | [AWSEncryptionKeyOptions](#AWSEncryptionKeyOptions) \\| [AzureEncryptionKeyOptions](#AzureEncryptionKeyOptions) \\| [GCPEncryptionKeyOptions](#GCPEncryptionKeyOptions) | masterKey to pass to createDataKey |\n| options.createCollectionOptions | CreateCollectionOptions | options to pass to createCollection, must include `encryptedFields` |\n\n**Returns**: Promise.<{collection: Collection.<TSchema>, encryptedFields: Document}> - - created collection and generated encryptedFields \n\n\n### *clientEncryption*.encrypt(value, options, [callback])\n\n| Param | Type | Description |\n| --- | --- | --- |\n| value | \\* | The value that you wish to serialize. Must be of a type that can be serialized into BSON |\n| options | [EncryptOptions](#EncryptOptions) | |\n| [callback] | [ClientEncryptionEncryptCallback](#ClientEncryptionEncryptCallback) | Optional callback to invoke when value is encrypted |\n\nExplicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must\nbe specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.\n\n**Returns**: Promise \\| void - If no callback is provided, returns a Promise that either resolves with the encrypted value, or rejects with an error. If a callback is provided, returns nothing. \n**Example** \n```js\n// Encryption with callback API\nfunction encryptMyData(value, callback) {\n clientEncryption.createDataKey('local', (err, keyId) => {\n if (err) {\n return callback(err);\n }\n clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' }, callback);\n });\n}\n```\n**Example** \n```js\n// Encryption with async/await api\nasync function encryptMyData(value) {\n const keyId = await clientEncryption.createDataKey('local');\n return clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });\n}\n```\n**Example** \n```js\n// Encryption using a keyAltName\nasync function encryptMyData(value) {\n await clientEncryption.createDataKey('local', { keyAltNames: 'mySpecialKey' });\n return clientEncryption.encrypt(value, { keyAltName: 'mySpecialKey', algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });\n}\n```\n\n\n### *clientEncryption*.encryptExpression(expression, options)\n**Experimental**: The Range algorithm is experimental only. It is not intended for production use. It is subject to breaking changes. \n\n| Param | Type | Description |\n| --- | --- | --- |\n| expression | object | a BSON document of one of the following forms: 1. A Match Expression of this form: `{$and: [{EncryptOptions](#EncryptOptions) | |\n\nEncrypts a Match Expression or Aggregate Expression to query a range index.\n\nOnly supported when queryType is \"rangePreview\" and algorithm is \"RangePreview\".\n\n**Returns**: Promise.<object> - Returns a Promise that either resolves with the encrypted value or rejects with an error. \n\n\n### *clientEncryption*.decrypt(value, callback)\n\n| Param | Type | Description |\n| --- | --- | --- |\n| value | Buffer \\| Binary | An encrypted value |\n| callback | [decryptCallback](#ClientEncryption..decryptCallback) | Optional callback to invoke when value is decrypted |\n\nExplicitly decrypt a provided encrypted value\n\n**Returns**: Promise \\| void - If no callback is provided, returns a Promise that either resolves with the decrypted value, or rejects with an error. If a callback is provided, returns nothing. \n**Example** \n```js\n// Decrypting value with callback API\nfunction decryptMyValue(value, callback) {\n clientEncryption.decrypt(value, callback);\n}\n```\n**Example** \n```js\n// Decrypting value with async/await API\nasync function decryptMyValue(value) {\n return clientEncryption.decrypt(value);\n}\n```\n\n\n### *clientEncryption*.askForKMSCredentials()\nAsk the user for KMS credentials.\n\nThis returns anything that looks like the kmsProviders original input\noption. It can be empty, and any provider specified here will override\nthe original ones.\n\n\n\n### *ClientEncryption*~decryptCallback\n\n| Param | Type | Description |\n| --- | --- | --- |\n| [err] | Error | If present, indicates an error that occurred in the process of decryption |\n| [result] | object | If present, is the decrypted result |\n\n\n\n## MongoCryptError\nAn error indicating that something went wrong specifically with MongoDB Client Encryption\n\n\n\n## MongoCryptCreateDataKeyError\n**Experimental**: Public Technical Preview \nAn error indicating that `ClientEncryption.createEncryptedCollection()` failed to create data keys\n\n\n\n## MongoCryptCreateEncryptedCollectionError\n**Experimental**: Public Technical Preview \nAn error indicating that `ClientEncryption.createEncryptedCollection()` failed to create a collection\n\n\n\n## MongoCryptAzureKMSRequestError\nAn error indicating that mongodb-client-encryption failed to auto-refresh Azure KMS credentials.\n\n\n\n### new MongoCryptAzureKMSRequestError(message, body)\n\n| Param | Type |\n| --- | --- |\n| message | string | \n| body | object \\| undefined | \n\n\n\n## BSONValue\nany serializable BSON value\n\n\n\n## Long\nA 64 bit integer, represented by the js-bson Long type.\n\n\n\n## KMSProviders\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| [aws] | object | Configuration options for using 'aws' as your KMS provider |\n| [aws.accessKeyId] | string | The access key used for the AWS KMS provider |\n| [aws.secretAccessKey] | string | The secret access key used for the AWS KMS provider |\n| [local] | object | Configuration options for using 'local' as your KMS provider |\n| [local.key] | Buffer | The master key used to encrypt/decrypt data keys. A 96-byte long Buffer. |\n| [azure] | object | Configuration options for using 'azure' as your KMS provider |\n| [azure.tenantId] | string | The tenant ID identifies the organization for the account |\n| [azure.clientId] | string | The client ID to authenticate a registered application |\n| [azure.clientSecret] | string | The client secret to authenticate a registered application |\n| [azure.identityPlatformEndpoint] | string | If present, a host with optional port. E.g. \"example.com\" or \"example.com:443\". This is optional, and only needed if customer is using a non-commercial Azure instance (e.g. a government or China account, which use different URLs). Defaults to \"login.microsoftonline.com\" |\n| [gcp] | object | Configuration options for using 'gcp' as your KMS provider |\n| [gcp.email] | string | The service account email to authenticate |\n| [gcp.privateKey] | string \\| Binary | A PKCS#8 encrypted key. This can either be a base64 string or a binary representation |\n| [gcp.endpoint] | string | If present, a host with optional port. E.g. \"example.com\" or \"example.com:443\". Defaults to \"oauth2.googleapis.com\" |\n\nConfiguration options that are used by specific KMS providers during key generation, encryption, and decryption.\n\n\n\n## DataKey\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| _id | UUID | A unique identifier for the key. |\n| version | number | A numeric identifier for the schema version of this document. Implicitly 0 if unset. |\n| [keyAltNames] | Array.<string> | Alternate names to search for keys by. Used for a per-document key scenario in support of GDPR scenarios. |\n| keyMaterial | Binary | Encrypted data key material, BinData type General. |\n| creationDate | Date | The datetime the wrapped data key material was imported into the Key Database. |\n| updateDate | Date | The datetime the wrapped data key material was last modified. On initial import, this value will be set to creationDate. |\n| status | number | 0 = enabled, 1 = disabled |\n| masterKey | object | the encrypted master key |\n\nA data key as stored in the database.\n\n\n\n## KmsProvider\nA string containing the name of a kms provider. Valid options are 'aws', 'azure', 'gcp', 'kmip', or 'local'\n\n\n\n## ClientSession\nThe ClientSession class from the MongoDB Node driver (see https://mongodb.github.io/node-mongodb-native/4.8/classes/ClientSession.html)\n\n\n\n## DeleteResult\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| acknowledged | boolean | Indicates whether this write result was acknowledged. If not, then all other members of this result will be undefined. |\n| deletedCount | number | The number of documents that were deleted |\n\nThe result of a delete operation from the MongoDB Node driver (see https://mongodb.github.io/node-mongodb-native/4.8/interfaces/DeleteResult.html)\n\n\n\n## BulkWriteResult\nThe BulkWriteResult class from the MongoDB Node driver (https://mongodb.github.io/node-mongodb-native/4.8/classes/BulkWriteResult.html)\n\n\n\n## FindCursor\nThe FindCursor class from the MongoDB Node driver (see https://mongodb.github.io/node-mongodb-native/4.8/classes/FindCursor.html)\n\n\n\n## ClientEncryptionDataKeyId\nThe id of an existing dataKey. Is a bson Binary value.\nCan be used for [ClientEncryption.encrypt](ClientEncryption.encrypt), and can be used to directly\nquery for the data key itself against the key vault namespace.\n\n\n\n## ClientEncryptionCreateDataKeyCallback\n\n| Param | Type | Description |\n| --- | --- | --- |\n| [error] | Error | If present, indicates an error that occurred in the creation of the data key |\n| [dataKeyId] | ClientEncryption~dataKeyId | If present, returns the id of the created data key |\n\n\n\n## AWSEncryptionKeyOptions\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| region | string | The AWS region of the KMS |\n| key | string | The Amazon Resource Name (ARN) to the AWS customer master key (CMK) |\n| [endpoint] | string | An alternate host to send KMS requests to. May include port number |\n\nConfiguration options for making an AWS encryption key\n\n\n\n## GCPEncryptionKeyOptions\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| projectId | string | GCP project id |\n| location | string | Location name (e.g. \"global\") |\n| keyRing | string | Key ring name |\n| keyName | string | Key name |\n| [keyVersion] | string | Key version |\n| [endpoint] | string | KMS URL, defaults to `https://www.googleapis.com/auth/cloudkms` |\n\nConfiguration options for making a GCP encryption key\n\n\n\n## AzureEncryptionKeyOptions\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| keyName | string | Key name |\n| keyVaultEndpoint | string | Key vault URL, typically `string | Key version |\n\nConfiguration options for making an Azure encryption key\n\n\n\n## RewrapManyDataKeyResult\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| [bulkWriteResult] | [BulkWriteResult](#BulkWriteResult) | An optional BulkWriteResult, if any keys were matched and attempted to be re-wrapped. |\n\n\n\n## ClientEncryptionEncryptCallback\n\n| Param | Type | Description |\n| --- | --- | --- |\n| [err] | Error | If present, indicates an error that occurred in the process of encryption |\n| [result] | Buffer | If present, is the encrypted result |\n\n\n\n## RangeOptions\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| min | [BSONValue](#BSONValue) | is required if precision is set. |\n| max | [BSONValue](#BSONValue) | is required if precision is set. |\n| sparsity | BSON.Long | |\n| precision | number \\| undefined | (may only be set for double or decimal128). |\n\nmin, max, sparsity, and range must match the values set in the encryptedFields of the destination collection.\nFor double and decimal128, min/max/precision must all be set, or all be unset.\n\n\n\n## EncryptOptions\n**Properties**\n\n| Name | Type | Description |\n| --- | --- | --- |\n| [keyId] | [ClientEncryptionDataKeyId](#ClientEncryptionDataKeyId) | The id of the Binary dataKey to use for encryption. |\n| [keyAltName] | string | A unique string name corresponding to an already existing dataKey. |\n| [algorithm] | string | The algorithm to use for encryption. Must be either `'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'`, `'AEAD_AES_256_CBC_HMAC_SHA_512-Random'`, `'Indexed'` or `'Unindexed'` |\n| [contentionFactor] | bigint \\| number | (experimental) - the contention factor. |\n| queryType | 'equality' \\| 'rangePreview' | (experimental) - the query type supported. |\n| [rangeOptions] | [RangeOptions](#RangeOptions) | (experimental) The index options for a Queryable Encryption field supporting \"rangePreview\" queries. |\n\nOptions to provide when encrypting data.\n\n","_attachments":{},"homepage":"https://github.com/mongodb/libmongocrypt#readme","bugs":{"url":"https://jira.mongodb.org/projects/NODE/issues/"},"license":"Apache-2.0"}