mongodb/node-mongodb-native · error · MongoCryptCreateEncryptedCollectionError

Unable to create collection

Error message

Unable to create collection: ${cause.message}

What it means

Thrown by ClientEncryption.createEncryptedCollection() when the underlying db.createCollection() call fails after data keys were successfully created. The error wraps the original cause and includes the full encryptedFields that were generated, so the caller can retry or clean up. This is a MongoCryptCreateEncryptedCollectionError.

Solutions

1. Check error.cause for the specific server-side error (duplicate collection, permissions, etc.)
2. If the collection already exists, drop it first or use a different name
3. Verify the server version supports the encryption features you are using (CSFLE requires 4.2+, QE requires 7.0+)
4. Inspect error.encryptedFields to understand the generated configuration

// Before calling createEncryptedCollection, check collection doesn't exist
const collections = await db.listCollections({ name }, { nameOnly: true }).toArray();
if (collections.length > 0) {
  throw new Error(`Collection ${name} already exists`);
}

try {
  const result = await clientEncryption.createEncryptedCollection(db, name, options);
} catch (error) {
  if (error instanceof MongoCryptCreateEncryptedCollectionError) {
    // Collection creation failed; data keys were already created
    console.error('Collection creation failed:', error.cause?.message);
    console.error('Generated encryptedFields:', error.encryptedFields);
    // If collection exists, drop and retry or use existing
  }
}

When it happens

Trigger: Data keys are created successfully, but the subsequent createCollection command fails. Common causes: the collection already exists, the encryptedFields configuration is invalid for the server version, insufficient permissions to create collections, or the server does not support encrypted collections.

Common situations: Running createEncryptedCollection when the collection already exists; server version too old for Queryable Encryption; invalid encryptedFields schema; MongoDB user lacks createCollection privileges; the encryptedFields configuration doesn't match what the server expects.

Related errors

• Unable to complete creating data keys
• Can only provide a custom AWS credential provider when the…
• Cannot set both proxyOptions and kmsConnectCallback
• Missing required option `keyVaultNamespace`
• Option "keyAltNames" must be an array of strings, but was…

AI-assisted analysis of mongodb/node-mongodb-native@dce7939f86 (2026-08-11). Data as JSON: /api/errors/8f6b72bbaca946ab. Report an issue: GitHub.

Appendix: source

Thrown at src/client-side-encryption/client_encryption.ts:635

      const rejection = createDataKeyResolutions.find(
        (result): result is PromiseRejectedResult => result.status === 'rejected'
      );
      if (rejection != null) {
        throw new MongoCryptCreateDataKeyError(encryptedFields, { cause: rejection.reason });
      }
    }

    try {
      const collection = await db.createCollection<TSchema>(name, {
        ...createCollectionOptions,
        encryptedFields,
        timeoutMS: timeoutContext?.csotEnabled()
          ? timeoutContext?.getRemainingTimeMSOrThrow()
          : undefined
      });
      return { collection, encryptedFields };
    } catch (cause) {
      throw new MongoCryptCreateEncryptedCollectionError(encryptedFields, { cause });
    }
  }

  /**
   * Explicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must
   * be specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.
   *
   * @param value - The value that you wish to serialize. Must be of a type that can be serialized into BSON
   * @param options -
   * @returns a Promise that either resolves with the encrypted value, or rejects with an error.
   *
   * @example
   * ```ts
   * // Encryption with async/await api
   * async function encryptMyData(value) {
   *   const keyId = await clientEncryption.createDataKey('local');
   *   return clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
   * }

View on GitHub (pinned to dce7939f86)