MongoDB Encryption at Rest using Customer Key Management API

openapi: 3.0.1
info:
  description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n  --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n  --header \"Content-Type: application/x-www-form-urlencoded\" \\\n  --header \"Accept: application/json\" \\\n  --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
  license:
    name: CC BY-NC-SA 3.0 US
    url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
  termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
  title: MongoDB Atlas Administration Access Tracking Encryption at Rest using Customer Key Management API
  version: '2.0'
  x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns and edits the Encryption at Rest using Customer Key Management configuration. MongoDB Cloud encrypts all storage whether or not you use your own key management.
  name: Encryption at Rest using Customer Key Management
paths:
  /api/atlas/v2/groups/{groupId}/encryptionAtRest:
    get:
      description: 'Returns the configuration for encryption at rest using the keys you manage through your cloud provider. MongoDB Cloud encrypts all storage even if you don''t use your own key management. This resource requires the requesting Service Account or API Key to have the Project Owner role.


        **LIMITED TO M10 OR GREATER:** MongoDB Cloud limits this feature to dedicated cluster tiers of M10 and greater.'
      operationId: getGroupEncryptionAtRest
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/groupId'
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/EncryptionAtRest'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return One Configuration for Encryption at Rest Using Customer-Managed Keys for One Project
      tags:
      - Encryption at Rest using Customer Key Management
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api encryptionAtRestUsingCustomerKeyManagement getEncryptionAtRest --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupEncryptionAtRestApiParams{}\n\tsdkResp, httpResp, err := client.EncryptionatRestusingCustomerKeyManagementApi.\n\t\tGetGroupEncryptionAtRestWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/getGroupEncryptionAtRest
      x-xgen-operation-id-override: getEncryptionAtRest
    patch:
      description: "Updates the configuration for encryption at rest using the keys you manage through your cloud provider. MongoDB Cloud encrypts all storage even if you don't use your own key management. This resource requires the requesting Service Account or API Key to have the Project Owner role. This feature isn't available for `M0` free clusters, `M2`, `M5`, or serverless clusters.\n\n After you configure at least one Encryption at Rest using a Customer Key Management provider for the MongoDB Cloud project, Project Owners can enable Encryption at Rest using Customer Key Management for each MongoDB Cloud cluster for which they require encryption. The Encryption at Rest using Customer Key Management provider doesn't have to match the cluster cloud service provider. MongoDB Cloud doesn't automatically rotate user-managed encryption keys. Defer to your preferred Encryption at Rest using Customer Key Management provider's documentation and guidance for best practices on key rotation. MongoDB Cloud automatically creates a 90-day key rotation alert when you configure Encryption at Rest using Customer Key Management using your Key Management in an MongoDB Cloud project. MongoDB Cloud encrypts all storage whether or not you use your own key management."
      operationId: updateGroupEncryptionAtRest
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/groupId'
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/EncryptionAtRest'
        description: 'Required parameters depend on whether someone has enabled Encryption at Rest using Customer Key Management:


          If you have enabled Encryption at Rest using Customer Key Management (CMK), Atlas requires all of the parameters for the desired encryption provider.


          - To use AWS Key Management Service (KMS), MongoDB Cloud requires all the fields in the `awsKms` object.

          - To use Azure Key Vault, MongoDB Cloud requires all the fields in the `azureKeyVault` object.

          - To use Google Cloud Key Management Service (KMS), MongoDB Cloud requires all the fields in the `googleCloudKms` object For authentication, you must provide either `serviceAccountKey` (static credentials) or `roleId` (service-account–based authentication) Once `roleId` is configured, `serviceAccountKey` is no longer supported.


          If you enabled Encryption at Rest using Customer Key Management, administrators can pass only the changed fields for the `awsKms`, `azureKeyVault`, or `googleCloudKms` object to update the configuration to this endpoint.'
        required: true
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/EncryptionAtRest'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '409':
          $ref: '#/components/responses/conflict'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Update Encryption at Rest Configuration in One Project
      tags:
      - Encryption at Rest using Customer Key Management
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api encryptionAtRestUsingCustomerKeyManagement updateEncryptionAtRest --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.UpdateGroupEncryptionAtRestApiParams{}\n\tsdkResp, httpResp, err := client.EncryptionatRestusingCustomerKeyManagementApi.\n\t\tUpdateGroupEncryptionAtRestWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X PATCH \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/updateGroupEncryptionAtRest
      x-xgen-operation-id-override: updateEncryptionAtRest
  /api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints:
    get:
      description: Returns the private endpoints of the specified cloud provider for encryption at rest using customer key management.
      operationId: listGroupEncryptionAtRestPrivateEndpoints
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/groupId'
      - $ref: '#/components/parameters/includeCount'
      - $ref: '#/components/parameters/itemsPerPage'
      - $ref: '#/components/parameters/pageNum'
      - description: Human-readable label that identifies the cloud provider for the private endpoints to return.
        in: path
        name: cloudProvider
        required: true
        schema:
          enum:
          - AZURE
          - AWS
          type: string
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/PaginatedApiAtlasEARPrivateEndpointView'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return Private Endpoints for Encryption at Rest Using Customer Key Management for One Cloud Provider in One Project
      tags:
      - Encryption at Rest using Customer Key Management
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api encryptionAtRestUsingCustomerKeyManagement listRestPrivateEndpoints --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupEncryptionAtRestPrivateEndpointsApiParams{}\n\tsdkResp, httpResp, err := client.EncryptionatRestusingCustomerKeyManagementApi.\n\t\tListGroupEncryptionAtRestPrivateEndpointsWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/listGroupEncryptionAtRestPrivateEndpoints
      x-xgen-operation-id-override: listRestPrivateEndpoints
    post:
      description: Creates a private endpoint in the specified region for encryption at rest using customer key management.
      operationId: createGroupEncryptionAtRestPrivateEndpoint
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/groupId'
      - description: Human-readable label that identifies the cloud provider for the private endpoint to create.
        in: path
        name: cloudProvider
        required: true
        schema:
          enum:
          - AZURE
          - AWS
          type: string
      requestBody:
        content:
          application/vnd.atlas.2023-01-01+json:
            schema:
              $ref: '#/components/schemas/EARPrivateEndpoint'
        description: Creates a private endpoint in the specified region.
        required: true
      responses:
        '202':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/EARPrivateEndpoint'
              x-xgen-version: '2023-01-01'
          description: Accepted
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Create One Private Endpoint for Encryption at Rest Using Customer Key Management for One Cloud Provider in One Project
      tags:
      - Encryption at Rest using Customer Key Management
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api encryptionAtRestUsingCustomerKeyManagement createRestPrivateEndpoint --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupEncryptionAtRestPrivateEndpointApiParams{}\n\tsdkResp, httpResp, err := client.EncryptionatRestusingCustomerKeyManagementApi.\n\t\tCreateGroupEncryptionAtRestPrivateEndpointWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints\" \\\n  -d '{ <Payload> }'"
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  --header \"Content-Type: application/json\" \\\n  -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints\" \\\n  -d '{ <Payload> }'"
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/createGroupEncryptionAtRestPrivateEndpoint
      x-xgen-operation-id-override: createRestPrivateEndpoint
  /api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints/{endpointId}:
    delete:
      description: Deletes one private endpoint, identified by its ID, for encryption at rest using Customer Key Management.
      operationId: requestGroupEncryptionAtRestPrivateEndpointDeletion
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/groupId'
      - description: Human-readable label that identifies the cloud provider of the private endpoint to delete.
        in: path
        name: cloudProvider
        required: true
        schema:
          enum:
          - AZURE
          - AWS
          type: string
      - description: Unique 24-hexadecimal digit string that identifies the private endpoint to delete.
        in: path
        name: endpointId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      responses:
        '204':
          content:
            application/vnd.atlas.2023-01-01+json:
              x-xgen-version: '2023-01-01'
          description: This endpoint does not return a response body.
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Delete One Private Endpoint for Encryption at Rest Using Customer Key Management for One Cloud Provider from One Project
      tags:
      - Encryption at Rest using Customer Key Management
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api encryptionAtRestUsingCustomerKeyManagement requestPrivateEndpointDeletion --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.RequestGroupEncryptionAtRestPrivateEndpointDeletionApiParams{}\n\thttpResp, err := client.EncryptionatRestusingCustomerKeyManagementApi.\n\t\tRequestGroupEncryptionAtRestPrivateEndpointDeletionWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints/{endpointId}\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints/{endpointId}\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/requestGroupEncryptionAtRestPrivateEndpointDeletion
      x-xgen-method-verb-override:
        customMethod: 'True'
        verb: requestDeletion
      x-xgen-operation-id-override: requestPrivateEndpointDeletion
    get:
      description: Returns one private endpoint, identified by its ID, for encryption at rest using Customer Key Management.
      operationId: getGroupEncryptionAtRestPrivateEndpoint
      parameters:
      - $ref: '#/components/parameters/envelope'
      - $ref: '#/components/parameters/pretty'
      - $ref: '#/components/parameters/groupId'
      - description: Human-readable label that identifies the cloud provider of the private endpoint.
        in: path
        name: cloudProvider
        required: true
        schema:
          enum:
          - AZURE
          - AWS
          type: string
      - description: Unique 24-hexadecimal digit string that identifies the private endpoint.
        in: path
        name: endpointId
        required: true
        schema:
          pattern: ^([a-f0-9]{24})$
          type: string
      responses:
        '200':
          content:
            application/vnd.atlas.2023-01-01+json:
              schema:
                $ref: '#/components/schemas/EARPrivateEndpoint'
              x-xgen-version: '2023-01-01'
          description: OK
          headers:
            RateLimit-Limit:
              $ref: '#/components/headers/HeaderRateLimitLimit'
            RateLimit-Remaining:
              $ref: '#/components/headers/HeaderRateLimitRemaining'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/notFound'
        '429':
          $ref: '#/components/responses/tooManyRequests'
        '500':
          $ref: '#/components/responses/internalServerError'
      summary: Return One Private Endpoint for Encryption at Rest Using Customer Key Management for One Cloud Provider in One Project
      tags:
      - Encryption at Rest using Customer Key Management
      x-codeSamples:
      - lang: cURL
        label: Atlas CLI
        source: atlas api encryptionAtRestUsingCustomerKeyManagement getRestPrivateEndpoint --help
      - lang: go
        label: Go
        source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.GetGroupEncryptionAtRestPrivateEndpointApiParams{}\n\tsdkResp, httpResp, err := client.EncryptionatRestusingCustomerKeyManagementApi.\n\t\tGetGroupEncryptionAtRestPrivateEndpointWithParams(ctx, params).\n\t\tExecute()\n}\n"
      - lang: cURL
        label: curl (Service Accounts)
        source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints/{endpointId}?pretty=true\""
      - lang: cURL
        label: curl (Digest)
        source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n  --digest --include \\\n  --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n  -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/encryptionAtRest/{cloudProvider}/privateEndpoints/{endpointId}?pretty=true\""
      x-rolesRequirements:
      - Project Owner
      x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/getGroupEncryptionAtRestPrivateEndpoint
      x-xgen-operation-id-override: getRestPrivateEndpoint
components:
  schemas:
    AWSKMSConfiguration:
      description: Amazon Web Services (AWS) KMS configuration details and encryption at rest configuration set for the specified project.
      externalDocs:
        description: Amazon Web Services Key Management Service
        url: https://www.mongodb.com/docs/atlas/security-aws-kms/
      properties:
        accessKeyID:
          description: Unique alphanumeric string that identifies an Identity and Access Management (IAM) access key with permissions required to access your Amazon Web Services (AWS) Customer Master Key (CMK).
          example: 019dd98d94b4bb778e7552e4
          maxLength: 128
          minLength: 16
          type: string
        customerMasterKeyID:
          description: Unique alphanumeric string that identifies the Amazon Web Services (AWS) Customer Master Key (CMK) you used to encrypt and decrypt the MongoDB master keys.
          maxLength: 2048
          minLength: 1
          type: string
        enabled:
          description: Flag that indicates whether someone enabled encryption at rest for the specified project through Amazon Web Services (AWS) Key Management Service (KMS). To disable encryption at rest using customer key management and remove the configuration details, pass only this parameter with a value of `false`.
          type: boolean
        region:
          description: Physical location where MongoDB Cloud deploys your AWS-hosted MongoDB cluster nodes. The region you choose can affect network latency for clients accessing your databases. When MongoDB Cloud deploys a dedicated cluster, it checks if a VPC or VPC connection exists for that provider and region. If not, MongoDB Cloud creates them as part of the deployment. MongoDB Cloud assigns the VPC a CIDR block. To limit a new VPC peering connection to one CIDR block and region, create the connection first. Deploy the cluster after the connection starts.
          enum:
          - US_GOV_WEST_1
          - US_GOV_EAST_1
          - US_EAST_1
          - US_EAST_2
          - US_WEST_1
          - US_WEST_2
          - CA_CENTRAL_1
          - EU_NORTH_1
          - EU_WEST_1
          - EU_WEST_2
          - EU_WEST_3
          - EU_CENTRAL_1
          - EU_CENTRAL_2
          - AP_EAST_1
          - AP_EAST_2
          - AP_NORTHEAST_1
          - AP_NORTHEAST_2
          - AP_NORTHEAST_3
          - AP_SOUTHEAST_1
          - AP_SOUTHEAST_2
          - AP_SOUTHEAST_3
          - AP_SOUTHEAST_4
          - AP_SOUTHEAST_5
          - AP_SOUTHEAST_6
          - AP_SOUTHEAST_7
          - AP_SOUTH_1
          - AP_SOUTH_2
          - SA_EAST_1
          - CN_NORTH_1
          - CN_NORTHWEST_1
          - ME_SOUTH_1
          - ME_CENTRAL_1
          - AF_SOUTH_1
          - EU_SOUTH_1
          - EU_SOUTH_2
          - IL_CENTRAL_1
          - CA_WEST_1
          - MX_CENTRAL_1
          - GLOBAL
          title: AWS Regions
          type: string
        requirePrivateNetworking:
          description: Enable connection to your Amazon Web Services (AWS) Key Management Service (KMS) over private networking.
          type: boolean
        roleId:
          description: Unique 24-hexadecimal digit string that identifies an Amazon Web Services (AWS) Identity and Access Management (IAM) role. This IAM role has the permissions required to manage your AWS customer master key.
          example: 32b6e34b3d91647abb20e7b8
          pattern: ^([a-f0-9]{24})$
          type: string
          writeOnly: true
        secretAccessKey:
          description: Human-readable label of the Identity and Access Management (IAM) secret access key with permissions required to access your Amazon Web Services (AWS) customer master key.
          type: string
          writeOnly: true
        valid:
          description: Flag that indicates whether the Amazon Web Services (AWS) Key Management Service (KMS) encryption key can encrypt and decrypt data.
          readOnly: true
          type: boolean
      type: object
    Link:
      properties:
        href:
          description: Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
          example: https://cloud.mongodb.com/api/atlas
          type: string
        rel:
          description: Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
          example: self
          type: string
      type: object
    ApiError:
      properties:
        badRequestDetail:
          $ref: '#/components/schemas/BadRequestDetail'
        detail:
          description: Describes the specific conditions or reasons that cause each type of error.
          type: string
        error:
          description: HTTP status code returned with this error.
          externalDocs:
        

# --- truncated at 32 KB (60 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-encryption-at-rest-using-customer-key-management-api-openapi.yml