2

I was looking for a way to see what fields in an org are encrypted. I am aware of the encryption statistics, however I was hoping there was a way where I could do a SOQL query and return all the encrypted fields. If not, I can use the encryption statistics page.

2

Adding another answer to show how it works through callouts to metadata. This is done, because you cannot retrieve encryptionScheme throught simple Schema methods.

To use this code you need to have MetadataService class from https://github.com/financialforcedev/apex-mdapi/blob/master/apex-mdapi/src/classes/MetadataService.cls

Explanation: first of all I retrieve names of encrypted fields as I have done in the previous answer. However, next thing to do - is call for metadata info from salesforce, where encryptionScheme is populated in the response.

List<String> fullNamesOfEncryptedFields = new List<String>();

for (Schema.SObjectType object_i : Schema.getGlobalDescribe().values()) {
    for (Schema.SObjectField field_i : object_i.getDescribe().fields.getMap().values()) {
        if (field_i.getDescribe().isEncrypted()) {
            fullNamesOfEncryptedFields.add(object_i.getDescribe().getName() + '.' + field_i.getDescribe().getName());
        }
    }
}

MetadataService.MetadataPort service = new MetadataService.MetadataPort();
service.SessionHeader = new MetadataService.SessionHeader_element();
service.SessionHeader.sessionId = UserInfo.getSessionId();
service.CallOptions = new MetadataService.CallOptions_element();
service.timeout_x = 120000;

List<String> batch = new List<String>();
List<MetadataService.CustomField> mdInfo = new List<MetadataService.CustomField>();

for (String fullName_i : fullNamesOfEncryptedFields) {
    batch.add(fullName_i);

    if (batch.size() == 10) { //MAX_BATCH_METADATA_SIZE
        mdInfo.addAll((List<MetadataService.CustomField>) service.readMetadata('CustomField', batch).getRecords());
        batch.clear();
    }
}

if (batch.size() > 0) {
    mdInfo.addAll((List<MetadataService.CustomField>) service.readMetadata('CustomField', batch).getRecords());
}

for (MetadataService.CustomField field_i : mdInfo) {
    system.debug(field_i.fullName + ' ' + field_i.encryptionScheme);
}
11

It can be done through apex execution, not through SOQL:

for (Schema.SObjectType object_i : Schema.getGlobalDescribe().values()) {
    for (Schema.SObjectField field_i : object_i.getDescribe().fields.getMap().values()) {
        if (field_i.getDescribe().isEncrypted()) {
            system.debug(object_i.getDescribe().name + ': ' + field_i.getDescribe().getName());
        }
    }
}
  • 1
    Hi @Mariia, that worked great! Is there a way to see what type of encryption is used on each field? For example, could it tell me when case insensitive deterministic is used vs probabilistic? – TestMcTesterson Jul 8 at 15:13
  • No, this cannot be done with simple schema methods, you need to use metadataService to get this. I mean readResult for CustomField and check for fields: encrypted and encryptionScheme. – Mariia Illarionova Jul 9 at 7:16
  • @TestMcTesterson Added another answer with explanation on how to get encryption schema for encrypted fields through metadata. – Mariia Illarionova Jul 9 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.