mongodb/node-mongodb-native · error · MongoCryptCreateEncryptedCollectionError

Unable to create collection: ${cause.message}

Error message

Unable to create collection: ${cause.message}

What it means

Thrown as MongoCryptCreateEncryptedCollectionError from ClientEncryption.createEncryptedCollection when the underlying db.createCollection call (made with encryptedFields) fails. The driver wraps the server error so callers can distinguish create-collection failures from data-key creation failures. The server-side cause is attached as err.cause.

Source

Thrown at src/client-side-encryption/client_encryption.ts:635

      const rejection = createDataKeyResolutions.find(
        (result): result is PromiseRejectedResult => result.status === 'rejected'
      );
      if (rejection != null) {
        throw new MongoCryptCreateDataKeyError(encryptedFields, { cause: rejection.reason });
      }
    }

    try {
      const collection = await db.createCollection<TSchema>(name, {
        ...createCollectionOptions,
        encryptedFields,
        timeoutMS: timeoutContext?.csotEnabled()
          ? timeoutContext?.getRemainingTimeMSOrThrow()
          : undefined
      });
      return { collection, encryptedFields };
    } catch (cause) {
      throw new MongoCryptCreateEncryptedCollectionError(encryptedFields, { cause });
    }
  }

  /**
   * Explicitly encrypt a provided value. Note that either `options.keyId` or `options.keyAltName` must
   * be specified. Specifying both `options.keyId` and `options.keyAltName` is considered an error.
   *
   * @param value - The value that you wish to serialize. Must be of a type that can be serialized into BSON
   * @param options -
   * @returns a Promise that either resolves with the encrypted value, or rejects with an error.
   *
   * @example
   * ```ts
   * // Encryption with async/await api
   * async function encryptMyData(value) {
   *   const keyId = await clientEncryption.createDataKey('local');
   *   return clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
   * }

View on GitHub (pinned to 3366c21a63)

Solutions

1. Inspect err.cause for the server error code (e.g. collection already exists -> code 48).
2. Drop or rename the existing collection before re-running, or switch to an explicit-encryption flow that does not create the collection.
3. Confirm the target mongod version supports the encrypted fields feature and that encryptedFields is well-formed.

Example fix

// before
await ce.createEncryptedCollection(db, 'patients', { encryptedFields, provider: 'local', createCollectionOptions: {} });
// NamespaceExists error wrapped

// after
await db.dropCollection('patients').catch(() => {});
await ce.createEncryptedCollection(db, 'patients', { encryptedFields, provider: 'local', createCollectionOptions: {} });

// Pre-flight: ensure the collection does not exist
const exists = !!(await db.listCollections({ name }).toArray()).length;
if (exists) throw new Error('collection exists; drop or use explicit encryption');

// Not applicable: server-side DDL error, not a type.

try {
  await ce.createEncryptedCollection(db, name, opts);
} catch (err) {
  if (err.name === 'MongoCryptCreateEncryptedCollectionError') {
    if (err.cause?.code === 48 /* NamespaceExists */) await db.dropCollection(name);
    /* retry */
  } else throw err;
}

When it happens

Trigger: Calling createEncryptedCollection when the collection already exists, when the encryptedFields config is invalid per server rules, when the server version does not support QE, or when the user lacks createCollection privileges.

Common situations: Re-running createEncryptedCollection without dropping the existing collection; mismatch between driver-side encryptedFields and server-side collection options; server without queryable encryption support; namespace permission errors.

Related errors

• Unable to complete creating data keys: ${cause.message}
• Cannot set both proxyOptions and kmsConnectCallback
• Can only provide a custom AWS credential provider when the s
• Missing required option `keyVaultNamespace`
• Option "keyAltNames" must be an array of strings, but was of

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/8f6b72bbaca946ab.json. Report an issue: GitHub.