Object Reference for the Salesforce Platform
j
No Results
Search Tips:
- Please consider misspellings
- Try different search keywords
ExternalEncryptionRootKey
Represents metadata about root keys stored in third-party key stores
that are used to generate and secure keys that encrypt Salesforce data. This object is
available in API version 58.0 and later.
Root keys are used to generate data encryption keys (DEKs) in Salesforce, which are
in turn used to encrypt and decrypt data. Root keys are also used as wrapping keys to
secure DEKs in the Salesforce database.
Supported Calls
describeSObjects(), query(), update()
Special Access Rules
This object is available as part of the Shield and
Salesforce Platform Encryption add-on subscriptions. Access to this object also requires
the Cache-Only Key Service add-on subscription.
Fields
| Field | Details |
|---|---|
| ActivatedDate |
|
| CreatedBy |
|
| Description |
|
| LastModifiedBy |
|
| Region |
|
| RootKeyIdentifier |
|
| RootKeyService |
|
| Status |
|
Usage
Three functions are available: describeSObjects(),query(), and update()
- Describe an external root key with describeSObjects()
-
To get information about the ExternalEncryptionRootKey sObject, use describe.
curl --location 'https://DOMAIN.my.salesforce.com/services/data/v62.0/sobjects/'\ ExternalEncryptionRootKey/describe' --header 'Content-Type: application/json' \ --header 'Authorization: Bearer TOKEN'On success, the response is the full JSON description of the ExternalEncryptionRootKey sObject.
- Get info on an external root key with query()
-
To get information about a specific root key, use query on the ExternalEncryptionRootKey sObject. Use the Identifier value as listed on the Key Management Page for the root key Id in the WHERE clause.
curl --location 'https://DOMAIN.my.salesforce.com/services/data/v62.0/query?' \ ?q=SELECT+FIELDS(ALL)+FROM+ExternalEncryptionRootKey+WHERE+Id='48q001t5ddzbucnAAA'+\ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer TOKEN'On success, the response is be similar to
{ "totalSize": 1, "done": true, "records": [ { "attributes": { "type": "ExternalEncryptionRootKey", "url": "/services/data/v62.0/sobjects/ExternalEncryptionRootKey/48q001t5ddzbucnAAA" }, "Id": "48q001t5ddzbucnAAA", "RootKeyIdentifier": "97ee8238-c5ac-4320-a2d0-a728aaefd567", "CreatedDate": "2024-08-05T17:32:11.841+0000", "CreatedBy": "charley.t.pulasky@wise-raccoon-od1ly6.com", "LastModifiedDate": "2025-02-12T18:36:11.063+0000", "LastModifiedBy": "charley.t.pulasky@wise-raccoon-od1ly6.com", "RootKeyService": "SF", "Region": "KEY REGION", "Status": "Active", "Description": null, "ActivatedDate": null } ] } - Update Status on an external rook key with update()
-
To update the status of an ExternalEncryptionRootKey from Active to Inactive, or from Inactive to Active, use PATCH on the specific key object. Use the vaule for Identifier as listed on the Key Management Page for the root key identifier.
curl --location --request PATCH 'https://DOMAIN.my.salesforce.com/services/data/v62.0/sobjects/ExternalEncryptionRootKey/ROOTKEYIDENTIFIER' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer TOKEN'\ --data '{ "Status": "Active" }'On success, the response is be similar to I SEE NO RESPONSE.