diff --git a/source/reference/security-client-side-automatic-json-schema.txt b/source/reference/security-client-side-automatic-json-schema.txt index c4b28ac4272..467afcaaaf6 100644 --- a/source/reference/security-client-side-automatic-json-schema.txt +++ b/source/reference/security-client-side-automatic-json-schema.txt @@ -229,12 +229,13 @@ and ``taxid-short`` fields for write or read operations to the .. autoencryptkeyword:: encrypt.keyId - *Array of UUID* + *Array of single UUID* The UUID of the data encryption key to use for encrypting field - values. Specify *one* string inside the array. The UUID is a BSON - `binary data `_ element of subtype - ``4``. + values. The UUID is a BSON `binary data + `_ element of subtype ``4``. + + Specify *one* string inside the array. If omitted, :ref:`mongocryptd` checks the full tree of parent fields for the nearest @@ -327,15 +328,16 @@ and ``taxid-short`` fields for write or read operations to the *Array of single UUID* - The UUID of a data encryption key. If an - :autoencryptkeyword:`encrypt` object is missing the + The UUID of a data encryption key. The UUID is a BSON `binary data + `_ element of subtype ``4``. + + Specify *one* string inside the array. + + If an :autoencryptkeyword:`encrypt` object is missing the :autoencryptkeyword:`~encrypt.keyId` field, ``mongocryptd`` searches the entire tree of parent objects to locate an :autoencryptkeyword:`encryptMetadata` object that specifies :autoencryptkeyword:`encryptMetadata.keyId`. - - The UUID is a BSON `binary data `_ - element of subtype ``4``. The data encryption key *must* exist in the key vault specified as part of the auto encryption :ref:`configuration options