diff --git a/reference/mongodb/mongodb/driver/manager/construct.xml b/reference/mongodb/mongodb/driver/manager/construct.xml
index a85ba29fe0..b0e41cd99c 100644
--- a/reference/mongodb/mongodb/driver/manager/construct.xml
+++ b/reference/mongodb/mongodb/driver/manager/construct.xml
@@ -714,7 +714,31 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
array
- Provides options to enable automatic client-side field level encryption.
+ Provides options to enable automatic client-side field level
+ encryption.
+
+
+
+ Automatic encryption is an enterprise-only feature that only
+ applies to operations on a collection. Automatic encryption is not
+ supported for operations on a database or view, and operations that
+ are not bypassed will result in error (see
+ libmongocrypt: Auto Encryption Allow-List). To bypass automatic encryption
+ for all operations, set bypassAutoEncryption to
+ &true;.
+
+
+ Automatic encryption requires the authenticated user to have the
+ listCollections
+ privilege action.
+
+
+ Explicit encryption/decryption and automatic decryption is a
+ community feature. The driver can still automatically decrypt when
+ bypassAutoEncryption is &true;.
+
+
+
The following options are supported:
@@ -734,10 +758,15 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
&mongodb.option.encryption.tlsOptions;
schemaMap
- array
+ arrayobject
- Allows specifying a local JSON schema that is used to configure encryption.
+ Map of collection namespaces to a local JSON schema. This is
+ used to configure automatic encryption. See
+ Automatic Encryption Rules
+ in the MongoDB manual for more information. It is an error to
+ specify a collection in both schemaMap and
+ encryptedFieldsMap.
@@ -762,9 +791,46 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
bypassAutoEncryptionbool
- With this option set to &true;, mongocryptd
- will not be spawned automatically. This is used to disable
- automatic encryption. Defaults to &false;.
+ If &true;, mongocryptd will not be spawned
+ automatically. This is used to disable automatic encryption.
+ Defaults to &false;.
+
+
+
+ bypassQueryAnalysis
+ bool
+
+ If &true;, automatic analysis of outgoing commands will be
+ disabled and mongocryptd will not be spawned
+ automatically. This enables the use case of explicit encryption
+ for querying indexed fields without requiring the enterprise
+ licensed crypt_shared library or
+ mongocryptd process. Defaults to &false;.
+
+
+
+ encryptedFieldsMap
+ arrayobject
+
+
+ Map of collection namespaces to an
+ encryptedFields document. This is used to
+ configure queryable encryption. See
+ Field Encryption and Queryability
+ in the MongoDB manual for more information. It is an error to
+ specify a collection in both
+ encryptedFieldsMap and
+ schemaMap.
+
+
+
+ Supplying an encryptedFieldsMap provides
+ more security than relying on an encrypted fields
+ encryptedFields obtained from the server.
+ It protects against a malicious server advertising a false
+ encryptedFields.
+
+
@@ -776,16 +842,14 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
mongocryptd process. The following options
are supported:
-
-: {
- mongocryptdURI: , // Defaults to "mongodb://localhost:27027"
- mongocryptdBypassSpawn: , // Defaults to false
- mongocryptdSpawnPath: , // Defaults to empty string and uses default system paths
- mongocryptdSpawnArgs: // Defaults to [ "--idleShutdownTimeoutSecs=60" ]
-}
-]]>
-
+
+ mongocryptdURI (string): URI to connect to an existing mongocryptd process. Defaults to "mongodb://localhost:27020".
+ mongocryptdBypassSpawn (bool): If &true;, prevent the driver from spawning mongocryptd. Defaults to &false;.
+ mongocryptdSpawnPath (string): Absolute path to search for mongocryptd binary. Defaults to empty string and consults system paths.
+ mongocryptdSpawnArgs (array): Array of string arguments to pass to mongocryptd when spawning. Defaults to ["--idleShutdownTimeoutSecs=60"].
+ cryptSharedLibPath (string): Absolute path to crypt_shared shared library. Defaults to empty string and consults system paths.
+ cryptSharedLibRequired (bool): If &true;, require the driver to load crypt_shared. Defaults to &false;.
+
See the Client-Side Encryption Specification for more information.
@@ -1009,6 +1073,18 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
+
+ PECL mongodb 1.14.0
+
+
+ Added the "bypassQueryAnalysis" and
+ "encryptedFieldsMap" auto encryption options.
+ Additional options pertaining to crypt_shared are
+ now supported in the "extraOptions" auto encryption
+ option.
+
+
+ PECL mongodb 1.13.0