EncryptedIndex instance backed by a new encrypted DiskIVF index on the server.
v0.17 introduces a single DiskIVF index type and removes the polymorphic
index_config argument. The previous IndexIVFFlat, IndexIVFPQ, and IndexIVFSQ types are gone — index configuration is now expressed as flat keyword arguments (dimension, metric, storage_precision).Parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
index_name | str | - | Unique name for the index |
index_key | bytes | None | (Optional) 32-byte encryption key. Required when kms_name is omitted (SDK-supplied KEK). Must be omitted when kms_name references a real KMS provider. |
kms_name | str | None | (Optional) Name of a kms.registry entry in the service YAML. When supplied, the service generates the KEK and wraps it under the named provider; the SDK never sees the plaintext key. |
dimension | int | None | (Optional) Vector dimensionality. If omitted, the server auto-detects from the first upsert. |
embedding_model | str | None | (Optional) sentence-transformers model name for automatic embedding generation. When set, dimension is inferred from the model. |
metric | str | None | (Optional) Distance metric ("euclidean", "squared_euclidean", or "cosine"). When None, the server applies its default. |
storage_precision | str | None | (Optional) On-disk rerank-vector dtype: "float32" (default) or "float16". |
Key Management Modes
At least one ofindex_key / kms_name must be supplied; supplying both against a real-KMS slot is rejected by the server with 400:
- SDK-supplied KEK — pass
index_key, omitkms_name. The server records the index withprovider: none; you must re-supply the same key on every subsequent call (load_index,query,upsert, etc.). - KMS-backed — pass
kms_name, omitindex_key. The server generates the DEK, wraps it under the named registry slot, and persists the envelope. Subsequent calls omitindex_keyentirely.
Returns
An instance ofEncryptedIndex bound to the newly created index. For KMS-backed indexes the returned handle holds no plaintext key.
Exceptions
ValueError
ValueError
- Raised if neither
index_keynorkms_nameis provided. - Raised if
index_keyis provided but is not exactly 32 bytes. - Raised by the server (re-wrapped as
ValueError) if bothindex_keyandkms_nameare provided against a real-KMS slot. - Raised by the server if the index name already exists, the embedding model is unsupported, or the KMS slot lookup fails.
Service Errors
Service Errors
- Raised if the CyborgDB service is unavailable, unreachable, or returns 5xx (including KMS-wrap failures as 502).
Example Usage
SDK-supplied key (basic)
For more info on
generate_key, refer to Generate Key.SDK-supplied key with explicit dimension
KMS-backed index
Auto-embedding
Float16 storage for reduced footprint
For more info on auto-generating embeddings, refer to Auto-Generate Embeddings.