com.mongodb.reactivestreams.client.vault

Interface ClientEncryption

All Superinterfaces:

AutoCloseable, Closeable

@Beta
public interface ClientEncryption
extends Closeable

The Key vault.

Used to create data encryption keys, and to explicitly encrypt and decrypt values when auto-encryption is not an option.

Note: support for client-side encryption should be considered as beta. Backwards-breaking changes may be made before the final release.

Since:

1.12

Method Summary

Modifier and Type	Method and Description
void	close()
org.reactivestreams.Publisher<org.bson.BsonBinary>	createDataKey(String kmsProvider) Create a data key with the given KMS provider.
org.reactivestreams.Publisher<org.bson.BsonBinary>	createDataKey(String kmsProvider, com.mongodb.client.model.vault.DataKeyOptions dataKeyOptions) Create a data key with the given KMS provider and options.
org.reactivestreams.Publisher<org.bson.BsonValue>	decrypt(org.bson.BsonBinary value) Decrypt the given value.
org.reactivestreams.Publisher<org.bson.BsonBinary>	encrypt(org.bson.BsonValue value, com.mongodb.client.model.vault.EncryptOptions options) Encrypt the given value with the given options.

Method Detail

createDataKey

org.reactivestreams.Publisher<org.bson.BsonBinary> createDataKey(String kmsProvider)

Create a data key with the given KMS provider.

Creates a new key document and inserts into the key vault collection.

Parameters:

kmsProvider - the KMS provider

Returns:

a Publisher containing the identifier for the created data key

createDataKey

org.reactivestreams.Publisher<org.bson.BsonBinary> createDataKey(String kmsProvider,
                                                                 com.mongodb.client.model.vault.DataKeyOptions dataKeyOptions)

Create a data key with the given KMS provider and options.

Creates a new key document and inserts into the key vault collection.

Parameters:

kmsProvider - the KMS provider

dataKeyOptions - the options for data key creation

Returns:

a Publisher containing the identifier for the created data key

encrypt

org.reactivestreams.Publisher<org.bson.BsonBinary> encrypt(org.bson.BsonValue value,
                                                           com.mongodb.client.model.vault.EncryptOptions options)

Encrypt the given value with the given options.

The driver may throw an exception for prohibited BSON value types

Parameters:

value - the value to encrypt

options - the options for data encryption

Returns:

a Publisher containing the encrypted value, a BSON binary of subtype 6

decrypt

org.reactivestreams.Publisher<org.bson.BsonValue> decrypt(org.bson.BsonBinary value)

Decrypt the given value.

Parameters:

value - the value to decrypt, which must be of subtype 6

Returns:

a Publisher containing the decrypted value

close

void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable