Newer Version Available

This content describes an older version of this product. View Latest

TenantSecret

This object stores an encrypted organization-specific key fragment that is used with the master secret to produce organization-specific data encryption keys. This object is available in API version 34.0 and later.

You can rotate the tenant secret once every four hours in a sandbox organization or every 24 hours in production organizations.

This information is about Shield Platform Encryption and not Classic Encryption.

Note

Supported Calls

create(), query(), retrieve(), update()

Fields

Field Name Details
Description
Type
string
Properties
Create, Nillable, Update
Description

The description of the tenant secret.

SecretValue
Type
base64
Properties
Nillable, Update
Description

The encrypted 256-bit secret value encoded in base64.

Status
Type
Restricted picklist
Properties
Filter, Group, Nillable, Restricted picklist, Sort
Description
The current status of the tenant secret. Values are:
ACTIVE
Can be used to encrypt and decrypt new or existing data.
ARCHIVED
Cannot encrypt new data. Can be used to decrypt data previously encrypted with this key when it was active.
DESTROYED
Cannot encrypt or decrypt data. Data encrypted with this key when it was active can no longer be decrypted. Files and attachments encrypted with this key can no longer be downloaded.
Version
Type
int
Properties
Filter, Group, idLookup, Sort
Description

The version number of this secret. The version number is unique within your organization.

Usage

Use this object to create or update your organization-specific tenant secret. For example, you can build an automated tenant secret creation and activation solution similar to the following.

  1. Start by creating an Apex class to create the new tenant secret.
    1global class CreateNewSecret implements Schedulable {
    2   global void execute(SchedulableContext SC) {
    3      TenantSecret k = new TenantSecret ();
    4      k.description = 'Created new secret from scheduled job';
    5      insert k;
    6   }
    7}
  2. Schedule the Apex class to run at the specified interval.

    This Apex code only needs to be run a single time to schedule the job. This code runs the job every 90 days.

    1CreateNewSecret secret = new CreateNewSecret();
    2String schedule = '0 0 0 1 JAN,APR,JUL,OCT ?';
    3String jobID = system.schedule('Automated secret creation and activation', schedule, secret);
  3. Validate that the job is scheduled.
  4. Validate that tenant secrets are created after the job is run.

Here is an example of destroying a tenant secret.

Your tenant secret is unique to your organization and to the specific data to which it applies. Once you destroy a tenant secret, related data is not accessible unless you previously exported the key and then import the key back into Salesforce.

Warning

1TenantSecret secret = [SELECT Id FROM TenantSecret WHERE Version = 2];
2secret.SecretValue = NULL;
3update secret;