> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Supported Operations for Queryable Encryption

This page documents the specific data types, commands, query operators, update operators, aggregation stages, and aggregation expressions supported for Queryable Encryption compatible drivers. It outlines the behavior for operations using automatic encryption, and operations using explicit encryption.

**Note: Enterprise Feature**

Automatic encryption is available in MongoDB Enterprise and MongoDB Atlas

## Operations Using `BinData`

MongoDB stores Queryable Encryption encrypted fields as a [`BinData`](https://www.mongodb.com/docs/manual/reference/mongodb-extended-json-v1.md#mongodb-bsontype-data_binary) blob. Read and write operations issued against the encrypted `BinData` value may have unexpected or incorrect behavior as compared to issuing that same operation against the decrypted value. Certain operations have strict BSON type support where issuing them against a `BinData` value returns an error.

Official drivers compatible with Queryable Encryption parse read and write operations for operators or expressions that don't support `BinData` values.

## BSON Types

The BSON types you can encrypt for a field depend on the field's [query type.](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-query-operators)

Queryable Encryption supports [configuring](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md#std-label-qe-create-encryption-schema) `queryType: "equality"` for all [BSON types](https://www.mongodb.com/docs/manual/reference/bson-types.md#std-label-bson-types) **except** the following:

- `array`

- `decimal`: Decimal (IEEE 754 Decimal128)

- `double`: Double (IEEE 754 Binary64)

- `object`

Queryable Encryption supports [configuring](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md#std-label-qe-create-encryption-schema) `queryType: "range"` for the following [BSON types:](https://www.mongodb.com/docs/manual/reference/bson-types.md#std-label-bson-types)

- `date`: UTC DateTime (Int64)

- `decimal`: Decimal (IEEE 754 Decimal128)

- `double`: Double (IEEE 754 Binary64)

- `int`: 32-bit integer

- `long`: 64-bit integer

**Note:**

The query type is the [configuration](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md#std-label-qe-create-encryption-schema) of the encrypted index, not the set of query operators by itself. In particular, `decimal` and `double` support `queryType: "range"`, and MongoDB evaluates equality queries on these fields using the range index.

Queryable Encryption supports [configuring](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md#std-label-qe-create-encryption-schema) `queryType: "prefix"`, `queryType: "suffix"`, and `queryType: "substring"` for the `string` BSON type only.

If you set `queryType: "none"`, MongoDB encrypts the field but does not make it queryable. Queryable Encryption supports `queryType: "none"` for all [BSON types](https://www.mongodb.com/docs/manual/reference/bson-types.md#std-label-bson-types) **except** the [unsupported BSON types](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-unsupported-bson-types) listed below, including `array` and `object`.

### Unsupported BSON Types

Regardless of query type, Queryable Encryption does not support encrypting the following BSON types because it doesn't adequately hide the type information for these values:

- [`MaxKey`](https://www.mongodb.com/docs/manual/reference/mongodb-extended-json.md#mongodb-bsontype-MaxKey)

- [`MinKey`](https://www.mongodb.com/docs/manual/reference/mongodb-extended-json.md#mongodb-bsontype-MinKey)

- `null`

- `undefined`

Queryable Encryption supports automatic and explicit encryption of `array` fields if the query type is `none`. You can encrypt an array, but not the fields within it, and you can't query an encrypted array.

Queryable Encryption does not support read or write operations on an encrypted field where the operation compares the encrypted field to the following value types:

- `array`

- `object`

## CRUD

- Queryable Encryption doesn't support multi-document update or delete operations. [`db.collection.updateMany()`](https://www.mongodb.com/docs/manual/reference/method/db.collection.updatemany.md#mongodb-method-db.collection.updateMany) and [`db.collection.bulkWrite()`](https://www.mongodb.com/docs/manual/reference/method/db.collection.bulkwrite.md#mongodb-method-db.collection.bulkWrite) with more than one update or delete operation aren't supported.

- Queryable Encryption bulk write operations can target only one namespace. If a [`bulkWrite`](https://www.mongodb.com/docs/manual/reference/command/bulkwrite.md#mongodb-dbcommand-dbcmd.bulkWrite) command specifies more than one namespace in `nsInfo`, the operation returns an error.

- Queryable Encryption limits [`db.collection.findAndModify()`](https://www.mongodb.com/docs/manual/reference/method/db.collection.findandmodify.md#mongodb-method-db.collection.findAndModify) arguments.

  - `fields` is not allowed

  - `new` must be false

- When performing an upsert operation, any encrypted fields in the filter are excluded from the insert.

## Supported Read and Write Commands

Queryable Encryption compatible drivers support automatic encryption with the following commands:

- [`aggregate`](https://www.mongodb.com/docs/manual/reference/command/aggregate.md#mongodb-dbcommand-dbcmd.aggregate)

- [`bulkWrite`](https://www.mongodb.com/docs/manual/reference/command/bulkwrite.md#mongodb-dbcommand-dbcmd.bulkWrite)

- [`count`](https://www.mongodb.com/docs/manual/reference/command/count.md#mongodb-dbcommand-dbcmd.count)

- [`delete`](https://www.mongodb.com/docs/manual/reference/command/delete.md#mongodb-dbcommand-dbcmd.delete)

- [`explain`](https://www.mongodb.com/docs/manual/reference/command/explain.md#mongodb-dbcommand-dbcmd.explain)

- [`find`](https://www.mongodb.com/docs/manual/reference/command/find.md#mongodb-dbcommand-dbcmd.find)

- [`findAndModify`](https://www.mongodb.com/docs/manual/reference/command/findandmodify.md#mongodb-dbcommand-dbcmd.findAndModify)

- [`insert`](https://www.mongodb.com/docs/manual/reference/command/insert.md#mongodb-dbcommand-dbcmd.insert)

- [`update`](https://www.mongodb.com/docs/manual/reference/command/update.md#mongodb-dbcommand-dbcmd.update)

For any supported command, the drivers return an error if the command uses an unsupported operator, aggregation stage, or aggregation expression. For a complete list of the supported operators, stages, and expressions, see the following sections:

- [Supported Query Operators](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-query-operators)

- [Supported Update Operators](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-update-operators)

- [Supported Aggregation Stages](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-aggregation-stages)

- [Supported Aggregation Expressions](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-aggregation-expressions)

The following commands do not require automatic encryption. Official drivers configured for automatic encryption pass these commands directly to the [`mongod`:](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod)

- [`getMore`](https://www.mongodb.com/docs/manual/reference/command/getmore.md#mongodb-dbcommand-dbcmd.getMore) 

- [`authenticate`](https://www.mongodb.com/docs/manual/reference/command/authenticate.md#mongodb-dbcommand-dbcmd.authenticate)

- [`hello`](https://www.mongodb.com/docs/manual/reference/command/hello.md#mongodb-dbcommand-dbcmd.hello)

- [`logout`](https://www.mongodb.com/docs/manual/reference/command/logout.md#mongodb-dbcommand-dbcmd.logout)

- [`abortTransaction`](https://www.mongodb.com/docs/manual/reference/command/aborttransaction.md#mongodb-dbcommand-dbcmd.abortTransaction)

- [`commitTransaction`](https://www.mongodb.com/docs/manual/reference/command/committransaction.md#mongodb-dbcommand-dbcmd.commitTransaction)

- [`endSessions`](https://www.mongodb.com/docs/manual/reference/command/endsessions.md#mongodb-dbcommand-dbcmd.endSessions)

- [`startSession`](https://www.mongodb.com/docs/manual/reference/command/startsession.md#mongodb-dbcommand-dbcmd.startSession)

- [`create`](https://www.mongodb.com/docs/manual/reference/command/create.md#mongodb-dbcommand-dbcmd.create)

- [`createIndexes`](https://www.mongodb.com/docs/manual/reference/command/createindexes.md#mongodb-dbcommand-dbcmd.createIndexes)

- [`drop`](https://www.mongodb.com/docs/manual/reference/command/drop.md#mongodb-dbcommand-dbcmd.drop)

- [`dropDatabase`](https://www.mongodb.com/docs/manual/reference/command/dropdatabase.md#mongodb-dbcommand-dbcmd.dropDatabase)

- [`dropIndexes`](https://www.mongodb.com/docs/manual/reference/command/dropindexes.md#mongodb-dbcommand-dbcmd.dropIndexes)

- [`killCursors`](https://www.mongodb.com/docs/manual/reference/command/killcursors.md#mongodb-dbcommand-dbcmd.killCursors)

- [`listCollections`](https://www.mongodb.com/docs/manual/reference/command/listcollections.md#mongodb-dbcommand-dbcmd.listCollections)

- [`listDatabases`](https://www.mongodb.com/docs/manual/reference/command/listdatabases.md#mongodb-dbcommand-dbcmd.listDatabases)

- [`listIndexes`](https://www.mongodb.com/docs/manual/reference/command/listindexes.md#mongodb-dbcommand-dbcmd.listIndexes)

- [`renameCollection`](https://www.mongodb.com/docs/manual/reference/command/renamecollection.md#mongodb-dbcommand-dbcmd.renameCollection)

- [`ping`](https://www.mongodb.com/docs/manual/reference/command/ping.md#mongodb-dbcommand-dbcmd.ping)

Issuing any other command through a compatible driver configured for automatic encryption returns an error.

While automatic encryption does not encrypt the getMore command, the response to the command may contain encrypted field values.

- Applications configured with the correct Queryable Encryption options automatically decrypt those values.

- Applications without the correct encryption options see the encrypted values.

## Supported Query Types & Operators

Drivers configured for automatic encryption support a limited set of query operators when issued against an encrypted queryable field.

Querying non-encrypted fields or encrypted fields with a supported query type returns encrypted data that is then decrypted at the client.

Queryable Encryption currently supports the following query types:

- `none`

- `equality`

- `range`

- `prefix`

- `suffix`

- `substring`

If the query type is unspecified, it defaults to `none`. If the query type is `none`, MongoDB encrypts the field, and clients can't query it.

**Important: Comparison Support**

Comparison of an encrypted field to a plaintext value is supported.

```json
{$expr: {$eq: ["$encrypted1", "plaintext_value"]}}
```

Comparison of one encrypted field to another encrypted field will fail.

```json
{$expr: {$eq: ["$encrypted1", "$encrypted2"]}}
```

Fields configured for `queryType: "equality"` support the following expressions:

- [`$eq`](https://www.mongodb.com/docs/manual/reference/operator/query/eq.md#mongodb-query-op.-eq)

- [`$ne`](https://www.mongodb.com/docs/manual/reference/operator/query/ne.md#mongodb-query-op.-ne)

- [`$in`](https://www.mongodb.com/docs/manual/reference/operator/query/in.md#mongodb-query-op.-in)

- [`$nin`](https://www.mongodb.com/docs/manual/reference/operator/query/nin.md#mongodb-query-op.-nin)

- [`$and`](https://www.mongodb.com/docs/manual/reference/operator/query/and.md#mongodb-query-op.-and)

- [`$or`](https://www.mongodb.com/docs/manual/reference/operator/query/or.md#mongodb-query-op.-or)

- [`$not`](https://www.mongodb.com/docs/manual/reference/operator/query/not.md#mongodb-query-op.-not)

- [`$nor`](https://www.mongodb.com/docs/manual/reference/operator/query/nor.md#mongodb-query-op.-nor)

- [`$expr`](https://www.mongodb.com/docs/manual/reference/operator/query/expr.md#mongodb-query-op.-expr)

- [`$exists`](https://www.mongodb.com/docs/manual/reference/operator/query/exists.md#mongodb-query-op.-exists)

Range queries implicitly convert equality queries to [`$lte`](https://www.mongodb.com/docs/manual/reference/operator/query/lte.md#mongodb-query-op.-lte) and [`$gte`](https://www.mongodb.com/docs/manual/reference/operator/query/gte.md#mongodb-query-op.-gte). Thus, fields configured for `queryType: "range"` support all expressions above, as well as the following expressions:

- [`$lt`](https://www.mongodb.com/docs/manual/reference/operator/query/lt.md#mongodb-query-op.-lt)

- [`$lte`](https://www.mongodb.com/docs/manual/reference/operator/query/lte.md#mongodb-query-op.-lte)

- [`$gt`](https://www.mongodb.com/docs/manual/reference/operator/query/gt.md#mongodb-query-op.-gt)

- [`$gte`](https://www.mongodb.com/docs/manual/reference/operator/query/gte.md#mongodb-query-op.-gte)

Queries specifying any other query operator against an encrypted field return an error.

### Unsupported Queries

Queries that compare an encrypted field to `null` or a regular expression always throw an error, even if using a supported query operator.

When using a MongoClient configured for Queryable Encryption, the following query operators throw an error, even if issued against an unencrypted field:

- [`$text`](https://www.mongodb.com/docs/manual/reference/operator/query/text.md#mongodb-query-op.-text)

- [`$where`](https://www.mongodb.com/docs/manual/reference/operator/query/where.md#mongodb-query-op.-where)

- [`$jsonSchema`](https://www.mongodb.com/docs/manual/reference/operator/query/jsonschema.md#mongodb-query-op.-jsonSchema)

## Supported Update Operators

Drivers configured for automatic encryption support the following update operators when issued against encrypted fields:

- [`$set`](https://www.mongodb.com/docs/manual/reference/operator/update/set.md#mongodb-update-up.-set)

- [`$unset`](https://www.mongodb.com/docs/manual/reference/operator/update/unset.md#mongodb-update-up.-unset)

Updates specifying any other update operator against an encrypted field return an error.

Update operations with the following behavior throw an error, even if using a supported operator:

- The update operation produces an array inside of an encrypted path.

- The update operation uses aggregation expression syntax.

For update operations specifying a [query filter](https://www.mongodb.com/docs/manual/reference/command/update.md#std-label-update-command-q) on encrypted fields, the query filter must use only [supported operators](https://www.mongodb.com/docs/manual/core/csfle/reference/supported-operations.md#std-label-csfle-supported-query-operators) on those fields.

## Replacement-style Updates

Replacement-style updates are supported, however, if the replacement document contains a `Timestamp(0,0)` inside a top-level encrypted field, Queryable Encryption will error. The `(0,0)` value indicates that the [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) should generate the Timestamp.  [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) cannot generate encrypted fields.

## Unsupported Insert Operations

Compatible drivers configured for automatic encryption do not support insert commands with the following behavior:

- Inserting a document with `Timestamp(0,0)` associated to an encrypted field. The `(0,0)` value indicates that the [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) should generate the Timestamp. Since the [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod.md#mongodb-binary-bin.mongod) cannot generate encrypted fields, the resulting timestamp would be unencrypted.

## Unsupported Aggregation Stages

Automatic encryption will not support aggregation stages that read from or write to additional collections. These stages are:

- [`$out`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/out.md#mongodb-pipeline-pipe.-out)

- [`$merge`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/merge.md#mongodb-pipeline-pipe.-merge)

## Supported Aggregation Stages

Compatible drivers configured for automatic encryption support the following aggregation pipeline stages:

- [`$addFields`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/addfields.md#mongodb-pipeline-pipe.-addFields)

- [`$bucket`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/bucket.md#mongodb-pipeline-pipe.-bucket)

- [`$bucketAuto`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/bucketauto.md#mongodb-pipeline-pipe.-bucketAuto)

- [`$collStats`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/collstats.md#mongodb-pipeline-pipe.-collStats)

- [`$count`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/count.md#mongodb-pipeline-pipe.-count)

- [`$geoNear`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/geonear.md#mongodb-pipeline-pipe.-geoNear)

- [`$graphLookup`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/graphlookup.md#mongodb-pipeline-pipe.-graphLookup) (For usage requirements, see [`$lookup` and `$graphLookup` Behavior)](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-lookup-graphLookup-behavior)

- [`$group`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/group.md#mongodb-pipeline-pipe.-group) on unencrypted fields

- [`$indexStats`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/indexstats.md#mongodb-pipeline-pipe.-indexStats)

- [`$limit`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/limit.md#mongodb-pipeline-pipe.-limit)

- [`$lookup`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup.md#mongodb-pipeline-pipe.-lookup) (For usage requirements, see [`$lookup` and `$graphLookup` Behavior)](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-lookup-graphLookup-behavior)

- [`$match`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/match.md#mongodb-pipeline-pipe.-match)

- [`$project`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/project.md#mongodb-pipeline-pipe.-project)

- [`$redact`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/redact.md#mongodb-pipeline-pipe.-redact)

- [`$replaceRoot`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/replaceroot.md#mongodb-pipeline-pipe.-replaceRoot)

- [`$sample`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/sample.md#mongodb-pipeline-pipe.-sample)

- [`$skip`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/skip.md#mongodb-pipeline-pipe.-skip)

- [`$sort`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/sort.md#mongodb-pipeline-pipe.-sort)

- [`$sortByCount`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/sortbycount.md#mongodb-pipeline-pipe.-sortByCount)

- [`$unwind`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/unwind.md#mongodb-pipeline-pipe.-unwind)

Aggregation pipelines operating on collections configured for automatic encryption that specify any other stage return an error.

**Note:**

The `$rerank` stage isn't supported with clients configured for automatic encryption using Queryable Encryption. A pipeline that contains `$rerank` fails with an error such as `Unrecognized pipeline
    stage name: '$rerank'`.

The limitation applies to all collections, including collections that have no encrypted fields, and to the use of `$rerank` inside sub-pipelines such as [`$unionWith`.](https://www.mongodb.com/docs/manual/reference/operator/aggregation/unionwith.md#mongodb-pipeline-pipe.-unionWith)

For each supported pipeline stage, MongoDB tracks fields that *must* be encrypted as they pass through the supported pipelines and marks them for encryption.

Each supported stage must specify only supported [query operators](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-query-operators) and [aggregation expressions.](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-supported-aggregation-expressions)

### `$lookup` and `$graphLookup` Behavior

Starting in MongoDB 8.1, you can reference multiple encrypted collections in a [`$lookup`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup.md#mongodb-pipeline-pipe.-lookup) stage. However, `$lookup` does not support:

- Using an encrypted field as the join field in the `localField` or `foreignField`.

- Using any field in an encrypted array. An array is considered as encrypted if it contains any encrypted elements.

  - For example, you can't use any field within the resulting [as](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup.md#std-label-lookup-subquery-as) array of the `$lookup` operation.

Automatic encryption supports [`$graphLookup`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/graphlookup.md#mongodb-pipeline-pipe.-graphLookup) *only if* the `from` collection matches the collection the aggregation runs against. `$graphLookup` stages that reference a different `from` collection return an error.

Automatic encryption does not support "connectionless" aggregation metadata sources, which read metadata that doesn't pertain to a particular collection, such as:

- [`$currentOp`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/currentop.md#mongodb-pipeline-pipe.-currentOp)

- [MongoDB Change Streams](https://www.mongodb.com/docs/manual/changestreams.md#std-label-changeStreams) for watching a database or the whole cluster

- [`$listSessions`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/listsessions.md#mongodb-pipeline-pipe.-listSessions)

- [`$listLocalSessions`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/listlocalsessions.md#mongodb-pipeline-pipe.-listLocalSessions)

Automatic encryption does not support the [`$planCacheStats`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/plancachestats.md#mongodb-pipeline-pipe.-planCacheStats) stage as the result may contain sensitive information.

## Supported Aggregation Expressions

Compatible drivers configured for automatic encryption support the following expressions against encrypted fields configured for equality queries:

- [`$cond`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/cond.md#mongodb-expression-exp.-cond)

- [`$eq`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/eq.md#mongodb-expression-exp.-eq)

- [`$ifNull`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/ifnull.md#mongodb-expression-exp.-ifNull)

- [`$in`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/in.md#mongodb-expression-exp.-in)

- [`$let`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/let.md#mongodb-expression-exp.-let)

- [`$literal`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/literal.md#mongodb-expression-exp.-literal)

- [`$ne`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/ne.md#mongodb-expression-exp.-ne)

- [`$switch`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/switch.md#mongodb-expression-exp.-switch)

Compatible drivers configured for automatic encryption support the following expressions against encrypted fields configured for `prefix`, `suffix`, or `substring` queries:

- [`$encStrStartsWith`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/encstrstartswith.md#mongodb-expression-exp.-encStrStartsWith)

- [`$encStrEndsWith`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/encstrendswith.md#mongodb-expression-exp.-encStrEndsWith)

- [`$encStrContains`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/encstrcontains.md#mongodb-expression-exp.-encStrContains)

- [`$encStrNormalizedEq`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/encstrnormalizedeq.md#mongodb-expression-exp.-encStrNormalizedEq)

All other aggregation expressions return an error if issued against encrypted fields.

Aggregation stages with the following behavior return an error, even if using a supported aggregation expression:

| Expressions | Rejected Behavior | Example |
| --- | --- | --- |
| [`$cond`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/cond.md#mongodb-expression-exp.-cond) [`$switch`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/switch.md#mongodb-expression-exp.-switch) | The expression specifies a field whose encryption properties cannot be known until runtime *and* a subsequent aggregation stage includes an expression referencing that field. | `$addFields : {
  "valueWithUnknownEncryption" : {
    $cond : {
      if : { "$encryptedField" : "value" },
      then : "$encryptedField",
      else: "unencryptedValue"
    }
  }
},
{
  $match : {
    "valueWithUnknownEncryption" : "someNewValue"
  }
}` |
| [`$eq`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/eq.md#mongodb-expression-exp.-eq) [`$ne`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/ne.md#mongodb-expression-exp.-ne) | The expression creates a new field that references an encrypted field *and* operates on that new field in the same expression. | `{
  $eq : [
    {"newField" : "$encryptedField"},
    {"newField" : "value"
  ]
}` |
| [`$eq`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/eq.md#mongodb-expression-exp.-eq) [`$ne`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/ne.md#mongodb-expression-exp.-ne) | The expression references the prefix of an encrypted field within the comparison expression. | `{ $eq : [ "$prefixOfEncryptedField" , "value"] }` |
| [`$eq`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/eq.md#mongodb-expression-exp.-eq) [`$ne`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/ne.md#mongodb-expression-exp.-ne) | The result of the expression is compared to an encrypted field. | `{
  $eq : [
      "$encryptedField" ,
      { $ne : [ "field", "value" ] }
  ]
}` |
| [`$let`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/let.md#mongodb-expression-exp.-let) | The expression binds a variable to an encrypted field or attempts to rebind [`$$CURRENT`.](https://www.mongodb.com/docs/manual/reference/aggregation-variables.md#mongodb-variable-variable.CURRENT) | `{
  $let: {
    "vars" : {
      "newVariable" : "$encryptedField"
    }
  }
}` |
| [`$in`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/in.md#mongodb-expression-exp.-in) | The first argument to the expression *is* an encrypted field, *and* The second argument to the expression is *not* an array literal*-OR-*; The second argument to the expression is an encrypted field. | `{
  $in : [
    "$encryptedField" ,
    "$otherEncryptedField"
  ]
}` |