---
schema_version: "1"
id: 121609f9816ac34ab7d1642cb2186ca6c2f5e9084f4c1c93bc7006e729decb51
title: EncryptionKeySettings
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/api_meta/meta_encryptionkeysettings.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_encryptionkeysettings.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 94e84606ac224f6629b38d05b384f6b666ba6e2524c53effa07ef125575e1f9e
description: Represents an org’s encryption key settings, such as customer-supplied keys options and key derivation settings. This type extends the Metadata metadata type and inherits its fullName field.
---
# EncryptionKeySettings

Represents an org’s encryption key settings, such as customer-supplied keys options and key derivation settings. This type extends the Metadata metadata type and inherits its fullName field.

In the package manifest, all organization settings metadata types are accessed using the Settings name. See [Settings](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_settings.htm "Represents the organization settings related to a feature. For example, your password policies, session settings and network access controls are all available in the SecuritySettings component type.") for details.

## File Suffix and Directory Location

EncryptionKeySettings values are stored in the EncryptionKey.settings file in the settings folder. The .settings files are different from other named components because there’s only one settings file for each settings component.

## Version

EncryptionKeySettings is available in API versions 47.0 and later.

## Special Access Rules

To enable EncryptionKeySettings, you need the Customize Application and Manage Encryption Keys permissions.

## Fields

| Field Name | Field Type | Description |
| --- | --- | --- |
| canEncryptTransactionalDatabase | boolean | Indicates whether users can encrypt the transactional database (true) or can’t (false). The default value is false. If set to true, transactional database encryption is enabled and a transactional database tenant secret is generated. Available in API version 63.0 and later. |
| canExternalKeyManagement | boolean | Indicates whether External Key Management is available (true) or not (false). The default value is false. If set to true, users can configure connections to external key stores and use keys saved in those key stores to encrypt and decrypt Salesforce data. Available in API version 63.0 and later. |
| canManageDataCloudKeys | boolean | Indicates whether key management for Data 360 is enabled and an initial customer-managed root key is present (true) or not (false). Available in API version 63.0 and later. |
| canOptOutOfDerivationWithBYOK | boolean | Indicates that users can opt out of key derivation processes on a key-by-key basis when they upload key material (true) or can’t (false). The default value is false. |
| enableCacheOnlyKeys | boolean | Indicates whether the Cache-Only Key Service is available (true) or not (false). The default value is false. If set to true, users can configure a cache-only key callout connection and apply key material stored outside of Salesforce to data on demand. |
| enableReplayDetection | boolean | Indicates whether cache-only key callouts are protected from replay attacks by a nonce (true) or not (false). Requires enableCacheOnlyKeys=”true” before setting enableReplayDetection to true. |

## Declarative Metadata Sample Definition

The following is an example of the EncryptionKey.settings file:

<?xml version="1.0" encoding="UTF-8"?>
<EncryptionKeySettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <canEncryptTransactionalDatabase\>true</canEncryptTransactionalDatabase\>
    <canManageDataCloudKeys\>true</canManageDataCloudKeys\>
    <enableExternalKeyManagement\>true</enableExternalKeyManagement\>
</EncryptionKeySettings\>

## Example Package Manifest

The following is an example package manifest used to deploy or retrieve the encryption key settings metadata for an organization:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types\>
        <members\>EncryptionKey</members\>
        <name\>Settings</name\>
    </types\>
    <version\>47.0</version\>
</Package\>

## Wildcard Support in the Manifest File

The wildcard character \* (asterisk) in the package.xml manifest file doesn’t apply to metadata types for feature settings. The wildcard applies only when retrieving all settings, not for an individual setting. For details, see [Settings](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/meta_settings.htm). For information about using the manifest file, see [Deploying and Retrieving Metadata with the Zip File](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/file_based_zip_file.htm).