afv-library/skills/platform-data-and-tooling-api-context-get/assets/enterprise_api/DataEncryptionKey.json

{
  "sections": [
    "title",
    "description",
    "fields",
    "special_access_rules",
    "usage",
    "wsdl_segment",
    "field_reference"
  ],
  "title": "DataEncryptionKey - Data API",
  "description": "The DataEncryptionKey object is part of the Bring Your Own Key (BYOK) feature, which allows users to upload a data encryption key (DEK) using a public key generated by the Salesforce Shield Key Management Service (KMS). Customers create their own DEKs and upload them to Salesforce. Users access this entity via the API to list DEK keys for auditing purposes. They can also programmatically use this object to create the certificate and to upload key material. This object is available in API version 63.0 and later.",
  "fields_columns": [
    "type",
    "properties",
    "description"
  ],
  "fields": {
    "CreatedBy": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The email address of the user who created the DEK. For example, user@example.com."
    },
    "DataEncryptionKeyCertName": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The name of the certificate whose public key is used to encrypt the DEK during a remote key callout. When you want to create a BYOK-compatible certificate, use this property in a call to create() to name the certificate. You need to know the name to retrieve the certificate later. Specify only the file name. Salesforce will add the .crt extension when it creates the file."
    },
    "Description": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The user-defined description of the root key."
    },
    "DoesUseKeyDerivation": {
      "type": "boolean",
      "properties": "Create, Defaulted on create, Filter, Group, Sort, Update",
      "description": "Indicates whether the DEK is intended to be used as part of a derived key (true) or not (false). See Components Involved in Deriving Keys for information on derived keys. The default value is false."
    },
    "LastModifiedBy": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The email address of the user who most recently modified the key. For example, user@example.com."
    },
    "RootKeyIdentifier": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The unique key identifier assigned by Salesforce to the root key used to create the DEK."
    },
    "RootKeyKmsIdentifier": {
      "type": "string",
      "properties": "Create, Filter, Nillable, Sort, Update",
      "description": "The unique key identifier from the external KMS, such as an AWS Amazon Resource Name (ARN). For example, arn:aws:kms:us-west-2:123456789000:key/123ab456-7cd8-9012-3e4f-5gh678i901j2"
    },
    "SecretValue": {
      "type": "textarea",
      "properties": "Create, Nillable, Update",
      "description": "The encrypted 256-bit secret value encoded in base64."
    },
    "SessionToken": {
      "type": "textarea",
      "properties": "Create, Nillable, Update",
      "description": "Contains the token for the session that was active when the DEK was last wrapped. If the session is inactive, a new certificate is required in order to transmit the DEK."
    },
    "Source": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The source of the encryption key material. Values are: AWS—A tenant secret or DEK fetched from the Amazon Key Management Service DEKs with a Source value of AWS are listed as Fetched on the Key Management page in Setup. Salesforce—A Salesforce-generated DEK."
    },
    "Status": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The status of the key. Possible values are: Activation Pending—Salesforce is waiting for confirmation of a valid key policy in the external key store. Active—Can be used to encrypt new DEKs and decrypt existing DEKs. Archived—Can’t encrypt new DEKs. Can be used to decrypt previously created DEKs. Canceled—Root key activation canceled by a user. Inactive—The root key, and the DEKs that it encrypts, are inaccessible. Inaccessible DEKs can’t be used to decrypt data, which renders that data also inaccessible."
    },
    "Type": {
      "type": "string",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The type of DEK. This value appears in the Type picklist: Search Index—search index files. For Hyperforce orgs on API version 63.0 and later, create secrets of type SearchIndex using the DataEncryptionKey object. For Hyperforce orgs on API versions 62.0 and earlier, and for all non-Hyperforce orgs, create secrets of type SearchIndex using the TenantSecret object. You also specify a type of SearchIndex when you are creating a BYOK-compatible certificate using the DataEncryptionKey object."
    },
    "Version": {
      "type": "int",
      "properties": "Create, Filter, Group, Nillable, Sort, Update",
      "description": "The version number of this secret. The version number is unique within your org."
    }
  },
  "special_access_rules": "This object is available as part of the Shield and Salesforce Platform Encryption add-on subscriptions.",
  "usage": "Four functions are available: describe(),create(), query() and queryAll(). You use create() and queryAll() together to upload a Search Index Encryption DEK. Check the Examples section for how to do each of these steps.\n\nFour functions are available: describe(),create(), query() and queryAll().\n\nYou use create() and queryAll() together to upload a Search Index Encryption DEK. Check the Examples section for how to do each of these steps.",
  "wsdl_segment": "```xml\n<complexType name=\"DataEncryptionKey\">\n  <complexContent>\n    <extension base=\"ens:sObject\">\n      <sequence>\n        <element name=\"CreatedBy\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"CreatedDate\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:dateTime\"/>\n        <element name=\"DataEncryptionKeyCertName\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"Description\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"DoesUseKeyDerivation\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n        <element name=\"LastModifiedBy\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"LastModifiedDate\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:dateTime\"/>\n        <element name=\"RootKeyIdentifier\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"RootKeyKmsIdentifier\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"SecretValue\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"SessionToken\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"Source\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"Status\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"Type\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:string\"/>\n        <element name=\"Version\" nillable=\"true\" minOccurs=\"0\" type=\"xsd:int\"/>\n      </sequence>\n    </extension>\n  </complexContent>\n</complexType>\n```",
  "field_reference": {
    "CreatedBy": {
      "field_label": "Created By",
      "type": "string",
      "length": "64"
    },
    "CreatedDate": {
      "field_label": "Created Date",
      "type": "datetime"
    },
    "DataEncryptionKeyCertName": {
      "field_label": "Data Encryption Key Certificate Name",
      "type": "string",
      "length": "80"
    },
    "Description": {
      "field_label": "Description",
      "type": "string",
      "length": "100"
    },
    "DoesUseKeyDerivation": {
      "field_label": "Key Derivation",
      "type": "boolean"
    },
    "Id": {
      "field_label": "Data Encryption Key Id",
      "type": "id",
      "length": "18"
    },
    "LastModifiedBy": {
      "field_label": "Last Modified By",
      "type": "string",
      "length": "64"
    },
    "LastModifiedDate": {
      "field_label": "Last Modified Date",
      "type": "datetime"
    },
    "RootKeyIdentifier": {
      "field_label": "Root Key Identifier",
      "type": "string",
      "length": "15"
    },
    "RootKeyKmsIdentifier": {
      "field_label": "Root Key KMS Identifier",
      "type": "string",
      "length": "512"
    },
    "SecretValue": {
      "field_label": "Secret Value",
      "type": "textarea",
      "length": "2000"
    },
    "SessionToken": {
      "field_label": "Session Token",
      "type": "textarea",
      "length": "3000"
    },
    "Source": {
      "field_label": "Source",
      "type": "string",
      "length": "100"
    },
    "Status": {
      "field_label": "Status",
      "type": "string",
      "length": "32"
    },
    "Type": {
      "field_label": "Type",
      "type": "string",
      "length": "150"
    },
    "Version": {
      "field_label": "Version",
      "type": "int",
      "digits": "9"
    }
  },
  "field_reference_columns": [
    "field_label",
    "type",
    "length",
    "digits"
  ]
}