clientEncryptionKeyId