---
name: "mongoc_client_encryption_create_datakey"
section: "3"
platform: "linux"
package: "libmongoc-doc"
version: "1.30.4-1+deb13u3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/mongoc_client_encryption_create_datakey"
---

# mongoc\_client\_encryption\_create\_datakey(3)

## SYNOPSIS

```
bool
mongoc_client_encryption_create_datakey (
   mongoc_client_encryption_t *client_encryption,
   const char *kms_provider,
   const mongoc_client_encryption_datakey_opts_t *opts,
   bson_value_t *keyid,
   bson_error_t *error);
```

Creates a new key document in the key vault collection and sets **keyid** to the UUID of the newly created key if **keyid** is not NULL. The new key can be used to configure automatic encryption (see *mongoc\_client\_enable\_auto\_encryption()* and *mongoc\_client\_pool\_enable\_auto\_encryption()*) or for explicit encryption (see *mongoc\_client\_encryption\_encrypt()*).

The created key document is inserted into the key vault collection (identified via *mongoc\_client\_encryption\_opts\_set\_keyvault\_namespace()*) with majority write concern.

**keyid** is always initialized (even on error). Caller must call *bson\_value\_destroy()* on **keyid** to free.

## PARAMETERS

- •

  **client\_encryption**: A *mongoc\_client\_encryption\_t*.

- •

  **kms\_provider**: A string identifying the Key Management Service (KMS) provider used to encrypt the datakey (e.g. "aws" or "local").

- •

  **opts**: A *mongoc\_client\_encryption\_datakey\_opts\_t*

- •

  **keyid**: Optional. An uninitialized *bson\_value\_t* set to the UUID (BSON binary subtype 0x04) of the newly created key. Must be freed by *bson\_value\_destroy()*.

- •

  **error**: Optional. A *bson\_error\_t*.

## RETURNS

Returns **true** if successful. Returns **false** and sets **error** otherwise.

**SEE ALSO:**

```
mongoc_client_encryption_datakey_opts_t
```

## AUTHOR

MongoDB, Inc

## COPYRIGHT

2009-present, MongoDB, Inc.