Values (u.bd1fbe2ccff02fd1cddfdcb5f1e38e71.awso.0.9.1.doc.awso.cognito-idp.Awso_cognito

Sourceval service : Awso.Service.t

Sourceval apiVersion : string

Sourceval endpointPrefix : string

Sourceval serviceFullName : string

Sourceval signatureVersion : string

Sourceval protocol : string

Sourceval globalEndpoint : string

Sourceval targetPrefix : string

Sourceval simple_to_json : ('a -> Awso__Botodata.value) -> 'a -> Yojson.Safe.t

Sourceval composed_to_json : ('a -> Awso__Botodata.value) -> 'a -> Yojson.Safe.t

Sourceval to_query : ('a -> Awso.Client.Query.value) -> 'a -> Awso.Client.Query.t

Source

val structure_to_value_aux : 
  ('a * 'b option) list ->
  f:(('a * 'b) list -> 'c) ->
  [> `Structure of 'c ]

Source

val structure_to_value : 
  ('a * 'b option) list ->
  [> `Structure of ('a * 'b) list ]

Source

val structure_to_wrapped_value : 
  wrapper:'a ->
  response:'a ->
  ('b * 'c option) list ->
  [> `Structure of ('a * [> `Structure of ('b * 'c) list ]) list ]

Sourcemodule AccountTakeoverActionNotifyType : sig ... end

Sourcemodule AccountTakeoverEventActionType : sig ... end

Sourcemodule EmailNotificationBodyType : sig ... end

Sourcemodule EmailNotificationSubjectType : sig ... end

Sourcemodule ArnType : sig ... end

Sourcemodule S3ArnType : sig ... end

Sourcemodule AttributeNameType : sig ... end

Sourcemodule AttributeValueType : sig ... end

Sourcemodule DeliveryMediumType : sig ... end

Sourcemodule CustomEmailSenderLambdaVersionType : sig ... end

Sourcemodule CustomSMSSenderLambdaVersionType : sig ... end

Sourcemodule InboundFederationLambdaVersionType : sig ... end

Sourcemodule PreTokenGenerationLambdaVersionType : sig ... end

Sourcemodule ResourceServerScopeDescriptionType : sig ... end

Sourcemodule ResourceServerScopeNameType : sig ... end

Sourcemodule PriorityType : sig ... end

Sourcemodule RecoveryOptionNameType : sig ... end

Sourcemodule StringType : sig ... end

Sourcemodule AuthFactorType : sig ... end

Sourcemodule ChallengeName : sig ... end

Sourcemodule ChallengeResponse : sig ... end

Sourcemodule AssetBytesType : sig ... end

Sourcemodule AssetCategoryType : sig ... end

Sourcemodule AssetExtensionType : sig ... end

Sourcemodule ColorSchemeModeType : sig ... end

Sourcemodule ResourceIdType : sig ... end

Sourcemodule AccountTakeoverActionType : sig ... end

The automated response to a risk level for adaptive authentication in full-function, or ENFORCED, mode. You can assign an action to each risk level that threat protection evaluates.

Sourcemodule NotifyEmailType : sig ... end

The template for email messages that threat protection sends to a user when your threat protection automated response has a Notify action.

Sourcemodule CompromisedCredentialsEventActionType : sig ... end

Sourcemodule EventFilterType : sig ... end

Sourcemodule CloudWatchLogsConfigurationType : sig ... end

Configuration for the CloudWatch log group destination of user pool detailed activity logging, or of user activity log export with threat protection.

Sourcemodule EventSourceName : sig ... end

Sourcemodule FirehoseConfigurationType : sig ... end

Configuration for the Amazon Data Firehose stream destination of user activity log export with threat protection.

Sourcemodule LogLevel : sig ... end

Sourcemodule S3ConfigurationType : sig ... end

Configuration for the Amazon S3 bucket destination of user activity log export with threat protection.

Sourcemodule WebAuthnAuthenticatorTransportType : sig ... end

Sourcemodule AttributeType : sig ... end

The name and value of a user attribute.

Sourcemodule MFAOptionType : sig ... end

This data type is no longer supported. Applies only to SMS multi-factor authentication (MFA) configurations. Does not apply to time-based one-time password (TOTP) software token MFA configurations.

Sourcemodule CustomEmailLambdaVersionConfigType : sig ... end

The properties of a custom email sender Lambda trigger.

Sourcemodule CustomSMSLambdaVersionConfigType : sig ... end

The properties of a custom SMS sender Lambda trigger.

Sourcemodule InboundFederationLambdaType : sig ... end

The properties of an inbound federation Lambda trigger.

Sourcemodule PreTokenGenerationVersionConfigType : sig ... end

The properties of a pre token generation Lambda trigger.

Sourcemodule ResourceServerScopeType : sig ... end

One custom scope associated with a user pool resource server. This data type is a member of ResourceServerScopeType. For more information, see Scopes, M2M, and API authorization with resource servers.

Sourcemodule RecoveryOptionType : sig ... end

A recovery option for a user. The AccountRecoverySettingType data type is an array of this object. Each RecoveryOptionType has a priority property that determines whether it is a primary or secondary option. For example, if verified_email has a priority of 1 and verified_phone_number has a priority of 2, your user pool sends account-recovery messages to a verified email address but falls back to an SMS message if the user has a verified phone number. The admin_only option prevents self-service account recovery.

Sourcemodule EmailInviteMessageType : sig ... end

Sourcemodule EmailVerificationSubjectType : sig ... end

Sourcemodule SmsInviteMessageType : sig ... end

Sourcemodule AttributeDataType : sig ... end

Sourcemodule BooleanType : sig ... end

Sourcemodule CustomAttributeNameType : sig ... end

Sourcemodule NumberAttributeConstraintsType : sig ... end

The minimum and maximum values of an attribute that is of the number type, for example custom:age.

Sourcemodule StringAttributeConstraintsType : sig ... end

The minimum and maximum length values of an attribute that is of the string type, for example custom:department.

Sourcemodule VerifiedAttributeType : sig ... end

Sourcemodule AdvancedSecurityEnabledModeType : sig ... end

Sourcemodule PasswordHistorySizeType : sig ... end

Sourcemodule PasswordPolicyMinLengthType : sig ... end

Sourcemodule TemporaryPasswordValidityDaysType : sig ... end

Sourcemodule AllowedFirstAuthFactorsListType : sig ... end

Sourcemodule ChallengeResponseType : sig ... end

The responses to the challenge that you received in the previous request. Each challenge has its own required response parameters. The following examples are partial JSON request bodies that highlight challenge-response parameters. You must provide a SECRET_HASH parameter in all challenge responses to an app client that has a client secret. Include a DEVICE_KEY for device authentication. SELECT_CHALLENGE "ChallengeName": "SELECT_CHALLENGE", "ChallengeResponses": { "USERNAME": "[username]", "ANSWER": "[Challenge name]"} Available challenges are PASSWORD, PASSWORD_SRP, EMAIL_OTP, SMS_OTP, and WEB_AUTHN. Complete authentication in the SELECT_CHALLENGE response for PASSWORD, PASSWORD_SRP, and WEB_AUTHN: "ChallengeName": "SELECT_CHALLENGE", "ChallengeResponses": { "ANSWER": "WEB_AUTHN", "USERNAME": "[username]", "CREDENTIAL": "[AuthenticationResponseJSON]"} See AuthenticationResponseJSON. "ChallengeName": "SELECT_CHALLENGE", "ChallengeResponses": { "ANSWER": "PASSWORD", "USERNAME": "[username]", "PASSWORD": "[password]"} "ChallengeName": "SELECT_CHALLENGE", "ChallengeResponses": { "ANSWER": "PASSWORD_SRP", "USERNAME": "[username]", "SRP_A": "[SRP_A]"} For SMS_OTP and EMAIL_OTP, respond with the username and answer. Your user pool will send a code for the user to submit in the next challenge response. "ChallengeName": "SELECT_CHALLENGE", "ChallengeResponses": { "ANSWER": "SMS_OTP", "USERNAME": "[username]"} "ChallengeName": "SELECT_CHALLENGE", "ChallengeResponses": { "ANSWER": "EMAIL_OTP", "USERNAME": "[username]"} WEB_AUTHN "ChallengeName": "WEB_AUTHN", "ChallengeResponses": { "USERNAME": "[username]", "CREDENTIAL": "[AuthenticationResponseJSON]"} See AuthenticationResponseJSON. PASSWORD "ChallengeName": "PASSWORD", "ChallengeResponses": { "USERNAME": "[username]", "PASSWORD": "[password]"} PASSWORD_SRP "ChallengeName": "PASSWORD_SRP", "ChallengeResponses": { "USERNAME": "[username]", "SRP_A": "[SRP_A]"} SMS_OTP "ChallengeName": "SMS_OTP", "ChallengeResponses": {"SMS_OTP_CODE": "[code]", "USERNAME": "[username]"} EMAIL_OTP "ChallengeName": "EMAIL_OTP", "ChallengeResponses": {"EMAIL_OTP_CODE": "[code]", "USERNAME": "[username]"} SMS_MFA "ChallengeName": "SMS_MFA", "ChallengeResponses": {"SMS_MFA_CODE": "[code]", "USERNAME": "[username]"} PASSWORD_VERIFIER This challenge response is part of the SRP flow. Amazon Cognito requires that your application respond to this challenge within a few seconds. When the response time exceeds this period, your user pool returns a NotAuthorizedException error. "ChallengeName": "PASSWORD_VERIFIER", "ChallengeResponses": {"PASSWORD_CLAIM_SIGNATURE": "[claim_signature]", "PASSWORD_CLAIM_SECRET_BLOCK": "[secret_block]", "TIMESTAMP": [timestamp], "USERNAME": "[username]"} CUSTOM_CHALLENGE "ChallengeName": "CUSTOM_CHALLENGE", "ChallengeResponses": {"USERNAME": "[username]", "ANSWER": "[challenge_answer]"} NEW_PASSWORD_REQUIRED "ChallengeName": "NEW_PASSWORD_REQUIRED", "ChallengeResponses": {"NEW_PASSWORD": "[new_password]", "USERNAME": "[username]"} To set any required attributes that InitiateAuth returned in an requiredAttributes parameter, add "userAttributes.[attribute_name]": "[attribute_value]". This parameter can also set values for writable attributes that aren't required by your user pool. In a NEW_PASSWORD_REQUIRED challenge response, you can't modify a required attribute that already has a value. In AdminRespondToAuthChallenge or RespondToAuthChallenge, set a value for any keys that Amazon Cognito returned in the requiredAttributes parameter, then use the AdminUpdateUserAttributes or UpdateUserAttributes API operation to modify the value of any additional attributes. SOFTWARE_TOKEN_MFA "ChallengeName": "SOFTWARE_TOKEN_MFA", "ChallengeResponses": {"USERNAME": "[username]", "SOFTWARE_TOKEN_MFA_CODE": [authenticator_code]} DEVICE_SRP_AUTH "ChallengeName": "DEVICE_SRP_AUTH", "ChallengeResponses": {"USERNAME": "[username]", "DEVICE_KEY": "[device_key]", "SRP_A": "[srp_a]"} DEVICE_PASSWORD_VERIFIER "ChallengeName": "DEVICE_PASSWORD_VERIFIER", "ChallengeResponses": {"DEVICE_KEY": "[device_key]", "PASSWORD_CLAIM_SIGNATURE": "[claim_signature]", "PASSWORD_CLAIM_SECRET_BLOCK": "[secret_block]", "TIMESTAMP": [timestamp], "USERNAME": "[username]"} MFA_SETUP "ChallengeName": "MFA_SETUP", "ChallengeResponses": {"USERNAME": "[username]"}, "SESSION": "[Session ID from VerifySoftwareToken]" SELECT_MFA_TYPE "ChallengeName": "SELECT_MFA_TYPE", "ChallengeResponses": {"USERNAME": "[username]", "ANSWER": "[SMS_MFA|EMAIL_MFA|SOFTWARE_TOKEN_MFA]"} For more information about SECRET_HASH, see Computing secret hash values. For information about DEVICE_KEY, see Working with user devices in your user pool.

Sourcemodule DateType : sig ... end

Sourcemodule FeedbackValueType : sig ... end

Sourcemodule RiskDecisionType : sig ... end

Sourcemodule RiskLevelType : sig ... end

Sourcemodule WrappedBooleanType : sig ... end

Sourcemodule HexStringType : sig ... end

Sourcemodule RedirectUrlType : sig ... end

Sourcemodule ClientPermissionType : sig ... end

Sourcemodule ExplicitAuthFlowsType : sig ... end

Sourcemodule OAuthFlowType : sig ... end

Sourcemodule FeatureType : sig ... end

Sourcemodule RetryGracePeriodSecondsType : sig ... end

Sourcemodule ScopeType : sig ... end

Sourcemodule ProviderNameType : sig ... end

Sourcemodule TimeUnitsType : sig ... end

Sourcemodule LanguageIdType : sig ... end

Sourcemodule LinkUrlType : sig ... end

Sourcemodule AssetType : sig ... end

An image file from a managed login branding style in a user pool.

Sourcemodule AttributeMappingKeyType : sig ... end

Sourcemodule IdpIdentifierType : sig ... end

Sourcemodule RegionCodeType : sig ... end

Sourcemodule AccountTakeoverActionsType : sig ... end

A list of account-takeover actions for each level of risk that Amazon Cognito might assess with threat protection features.

Sourcemodule NotifyConfigurationType : sig ... end

The configuration for Amazon SES email messages that threat protection sends to a user when your adaptive authentication automated response has a Notify action.

Sourcemodule CompromisedCredentialsActionsType : sig ... end

Settings for user pool actions when Amazon Cognito detects compromised credentials with threat protection in full-function ENFORCED mode.

Sourcemodule EventFiltersType : sig ... end

Sourcemodule BlockedIPRangeListType : sig ... end

Sourcemodule SkippedIPRangeListType : sig ... end

Sourcemodule LogConfigurationType : sig ... end

The configuration of user event logs to an external Amazon Web Services service like Amazon Data Firehose, Amazon S3, or Amazon CloudWatch Logs.

Sourcemodule DeviceKeyType : sig ... end

Sourcemodule WebAuthnAuthenticatorAttachmentType : sig ... end

Sourcemodule WebAuthnAuthenticatorTransportsList : sig ... end

Sourcemodule AttributeListType : sig ... end

Sourcemodule MFAOptionListType : sig ... end

Sourcemodule UserStatusType : sig ... end

Sourcemodule UsernameType : sig ... end

Sourcemodule LambdaConfigType : sig ... end

A collection of user pool Lambda triggers. Amazon Cognito invokes triggers at several possible stages of user pool operations. Triggers can modify the outcome of the operations that invoked them.

Sourcemodule StatusType : sig ... end

Sourcemodule UserPoolIdType : sig ... end

Sourcemodule UserPoolNameType : sig ... end

Sourcemodule ClientIdType : sig ... end

Sourcemodule ClientNameType : sig ... end

Sourcemodule ClientSecretIdType : sig ... end

Sourcemodule ClientSecretType : sig ... end

Sourcemodule CompletionMessageType : sig ... end

Sourcemodule LongType : sig ... end

Sourcemodule PreSignedUrlType : sig ... end

Sourcemodule UserImportJobIdType : sig ... end

Sourcemodule UserImportJobNameType : sig ... end

Sourcemodule UserImportJobStatusType : sig ... end

Sourcemodule TermsEnforcementType : sig ... end

Sourcemodule TermsIdType : sig ... end

Sourcemodule TermsNameType : sig ... end

Sourcemodule ResourceServerIdentifierType : sig ... end

Sourcemodule ResourceServerNameType : sig ... end

Sourcemodule ResourceServerScopeListType : sig ... end

Sourcemodule IdentityProviderTypeType : sig ... end

Sourcemodule DescriptionType : sig ... end

Sourcemodule GroupNameType : sig ... end

Sourcemodule PrecedenceType : sig ... end

Sourcemodule RecoveryMechanismsType : sig ... end

Sourcemodule AdminCreateUserUnusedAccountValidityDaysType : sig ... end

Sourcemodule MessageTemplateType : sig ... end

The message template structure.

Sourcemodule AliasAttributeType : sig ... end

Sourcemodule EmailAddressType : sig ... end

Sourcemodule EmailSendingAccountType : sig ... end

Sourcemodule SESConfigurationSet : sig ... end

Sourcemodule SchemaAttributeType : sig ... end

A list of the user attributes and their properties in your user pool. The attribute schema contains standard attributes, custom attributes with a custom: prefix, and developer attributes with a dev: prefix. For more information, see User pool attributes. Developer-only dev: attributes are a legacy feature of user pools, and are read-only to all app clients. You can create and update developer-only attributes only with IAM-authenticated API operations. Use app client read/write permissions instead.

Sourcemodule AttributesRequireVerificationBeforeUpdateType : sig ... end

Sourcemodule AdvancedSecurityAdditionalFlowsType : sig ... end

Threat protection configuration options for additional authentication types in your user pool, including custom authentication.

Sourcemodule AdvancedSecurityModeType : sig ... end

Sourcemodule PasswordPolicyType : sig ... end

The password policy settings for a user pool, including complexity, history, and length requirements.

Sourcemodule SignInPolicyType : sig ... end

The policy for allowed types of authentication in a user pool. To activate this setting, your user pool must be in the Essentials tier or higher.

Sourcemodule TagKeysType : sig ... end

Sourcemodule TagValueType : sig ... end

Sourcemodule UsernameAttributeType : sig ... end

Sourcemodule DefaultEmailOptionType : sig ... end

Sourcemodule EmailVerificationMessageByLinkType : sig ... end

Sourcemodule EmailVerificationMessageType : sig ... end

Sourcemodule EmailVerificationSubjectByLinkType : sig ... end

Sourcemodule SmsVerificationMessageType : sig ... end

Sourcemodule HttpHeader : sig ... end

The HTTP header in the ContextData parameter.

Sourcemodule ChallengeResponseListType : sig ... end

Sourcemodule EventContextDataType : sig ... end

The context data that your application submitted in an authentication request with threat protection, as displayed in an AdminListUserAuthEvents response.

Sourcemodule EventFeedbackType : sig ... end

The feedback that your application submitted to a threat protection event log, as displayed in an AdminListUserAuthEvents response.

Sourcemodule EventResponseType : sig ... end

Sourcemodule EventRiskType : sig ... end

The risk evaluation by adaptive authentication, as displayed in an AdminListUserAuthEvents response. Contains evaluations of compromised-credentials detection and assessed risk level and action taken by adaptive authentication.

Sourcemodule EventType : sig ... end

Sourcemodule MessageType : sig ... end

Sourcemodule InvalidParameterExceptionReasonCodeType : sig ... end

Sourcemodule AccessTokenValidityType : sig ... end

Sourcemodule AnalyticsConfigurationType : sig ... end

The settings for Amazon Pinpoint analytics configuration. With an analytics configuration, your application can collect user-activity metrics for user notifications with a Amazon Pinpoint campaign. Amazon Pinpoint isn't available in all Amazon Web Services Regions. For a list of available Regions, see Amazon Cognito and Amazon Pinpoint Region availability.

Sourcemodule AuthSessionValidityType : sig ... end

Sourcemodule CallbackURLsListType : sig ... end

Sourcemodule ClientPermissionListType : sig ... end

Sourcemodule ExplicitAuthFlowsListType : sig ... end

Sourcemodule IdTokenValidityType : sig ... end

Sourcemodule LogoutURLsListType : sig ... end

Sourcemodule OAuthFlowsType : sig ... end

Sourcemodule PreventUserExistenceErrorTypes : sig ... end

Sourcemodule RefreshTokenRotationType : sig ... end

The configuration of your app client for refresh token rotation. When enabled, your app client issues new ID, access, and refresh tokens when users renew their sessions with refresh tokens. When disabled, token refresh issues only ID and access tokens.

Sourcemodule RefreshTokenValidityType : sig ... end

Sourcemodule ScopeListType : sig ... end

Sourcemodule SupportedIdentityProvidersListType : sig ... end

Sourcemodule TokenValidityUnitsType : sig ... end

The time units that, with IdTokenValidity, AccessTokenValidity, and RefreshTokenValidity, set and display the duration of ID, access, and refresh tokens for an app client. You can assign a separate token validity unit to each type of token.

Sourcemodule CodeDeliveryDetailsType : sig ... end

The delivery details for an email or SMS message that Amazon Cognito sent for authentication or verification.

Sourcemodule LinksType : sig ... end

Sourcemodule TermsSourceType : sig ... end

Sourcemodule AssetListType : sig ... end

Sourcemodule Document : sig ... end

Sourcemodule ManagedLoginBrandingIdType : sig ... end

Sourcemodule AttributeMappingType : sig ... end

Sourcemodule IdpIdentifiersListType : sig ... end

Sourcemodule ProviderDetailsType : sig ... end

Sourcemodule EmailMfaMessageType : sig ... end

Sourcemodule EmailMfaSubjectType : sig ... end

Sourcemodule SmsConfigurationType : sig ... end

User pool configuration for delivery of SMS messages with Amazon Simple Notification Service. To send SMS messages with Amazon SNS in the Amazon Web Services Region that you want, the Amazon Cognito user pool uses an Identity and Access Management (IAM) role in your Amazon Web Services account.

Sourcemodule RelyingPartyIdType : sig ... end

Sourcemodule UserVerificationType : sig ... end

Sourcemodule WebAuthnFactorConfigurationType : sig ... end

Sourcemodule CSSType : sig ... end

Sourcemodule CSSVersionType : sig ... end

Sourcemodule ImageUrlType : sig ... end

Sourcemodule AccountTakeoverRiskConfigurationType : sig ... end

The settings for automated responses and notification templates for adaptive authentication with threat protection features.

Sourcemodule CompromisedCredentialsRiskConfigurationType : sig ... end

Settings for compromised-credentials actions and authentication-event sources with threat protection in full-function ENFORCED mode.

Sourcemodule RiskExceptionConfigurationType : sig ... end

Exceptions to the risk evaluation configuration, including always-allow and always-block IP address ranges.

Sourcemodule LogConfigurationListType : sig ... end

Sourcemodule IntegerType : sig ... end

Sourcemodule NewDeviceMetadataType : sig ... end

Information that your user pool responds with in AuthenticationResultwhen you configure it to remember devices and a user signs in with an unrecognized device. Amazon Cognito presents a new device key that you can use to set up device authentication in a "Remember me on this device" authentication model.

Sourcemodule TokenModelType : sig ... end

Sourcemodule WebAuthnCredentialDescription : sig ... end

The details of a passkey, or webauthN, biometric or security-key authentication factor for a user.

Sourcemodule UserType : sig ... end

A user profile in a Amazon Cognito user pool.

Sourcemodule UserPoolDescriptionType : sig ... end

A short description of a user pool.

Sourcemodule UserPoolClientDescription : sig ... end

A short description of a user pool app client.

Sourcemodule ClientSecretDescriptorType : sig ... end

Contains information about a client secret, including its unique identifier, value, and creation timestamp.

Sourcemodule UserImportJobType : sig ... end

A user import job in a user pool. Describes the status of user import with a CSV file. For more information, see Importing users into user pools from a CSV file.

Sourcemodule TermsDescriptionType : sig ... end

The details of a set of terms documents. For more information, see Terms documents.

Sourcemodule ResourceServerType : sig ... end

The details of a resource server configuration and associated custom scopes in a user pool.

Sourcemodule ProviderDescription : sig ... end

The details of a user pool identity provider (IdP), including name and type.

Sourcemodule GroupType : sig ... end

A user pool group. Contains details about the group and the way that it contributes to IAM role decisions with identity pools. Identity pools can make decisions about the IAM role to assign based on groups: users get credentials for the role associated with their highest-priority group.

Sourcemodule DeviceType : sig ... end

Information about a user's device that they've registered for device SRP authentication in your application. For more information, see Working with user devices in your user pool.

Sourcemodule ChallengeNameType : sig ... end

Sourcemodule AccountRecoverySettingType : sig ... end

The settings for user message delivery in forgot-password operations. Contains preference for email or SMS message delivery of password reset codes, or for admin-only password reset.

Sourcemodule AdminCreateUserConfigType : sig ... end

The settings for administrator creation of users in a user pool. Contains settings for allowing user sign-up, customizing invitation messages to new users, and the amount of time before temporary passwords expire.

Sourcemodule AliasAttributesListType : sig ... end

Sourcemodule DeletionProtectionType : sig ... end

Sourcemodule DeviceConfigurationType : sig ... end

The device-remembering configuration for a user pool. When you provide a value for any property of DeviceConfiguration, you activate the device remembering for the user pool.

Sourcemodule DomainType : sig ... end

Sourcemodule EmailConfigurationType : sig ... end

The email configuration of your user pool. The email configuration type sets your preferred sending method, Amazon Web Services Region, and sender for messages from your user pool. Amazon Cognito can send email messages with Amazon Simple Email Service resources in the Amazon Web Services Region where you created your user pool, and in alternate Regions in some cases. For more information on the supported Regions, see Email settings for Amazon Cognito user pools.

Sourcemodule SchemaAttributesListType : sig ... end

Sourcemodule UserAttributeUpdateSettingsType : sig ... end

The settings for updates to user attributes. These settings include the property AttributesRequireVerificationBeforeUpdate, a user-pool setting that tells Amazon Cognito how to handle changes to the value of your users' email address and phone number attributes. For more information, see Verifying updates to email addresses and phone numbers.

Sourcemodule UserPoolAddOnsType : sig ... end

Contains settings for activation of threat protection, including the operating mode and additional authentication types. To log user security information but take no action, set to AUDIT. To configure automatic security responses to potentially unwanted traffic to your user pool, set to ENFORCED. For more information, see Adding advanced security to a user pool. To activate this setting, your user pool must be on the Plus tier.

Sourcemodule UserPoolMfaType : sig ... end

Sourcemodule UserPoolPolicyType : sig ... end

A list of user pool policies. Contains the policy that sets password-complexity requirements.

Sourcemodule UserPoolTagsType : sig ... end

Sourcemodule UserPoolTierType : sig ... end

Sourcemodule UsernameAttributesListType : sig ... end

Sourcemodule UsernameConfigurationType : sig ... end

The configuration of a user pool for username case sensitivity.

Sourcemodule VerificationMessageTemplateType : sig ... end

The template for the verification message that your user pool delivers to users who set an email address or phone number attribute.

Sourcemodule VerifiedAttributesListType : sig ... end

Sourcemodule AWSAccountIdType : sig ... end

Sourcemodule CustomDomainConfigType : sig ... end

The configuration for a hosted UI custom domain.

Sourcemodule DomainStatusType : sig ... end

Sourcemodule DomainVersionType : sig ... end

Sourcemodule S3BucketType : sig ... end

Sourcemodule WrappedIntegerType : sig ... end

Sourcemodule HttpHeaderList : sig ... end

Sourcemodule AuthEventType : sig ... end

One authentication event that Amazon Cognito logged in a user pool with threat protection active. Contains user and device metadata and a risk assessment from your user pool.

Sourcemodule AliasExistsException : sig ... end

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

Sourcemodule CodeMismatchException : sig ... end

This exception is thrown if the provided code doesn't match what the server was expecting.

Sourcemodule ExpiredCodeException : sig ... end

This exception is thrown if a code has expired.

Sourcemodule ForbiddenException : sig ... end

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

Sourcemodule InternalErrorException : sig ... end

This exception is thrown when Amazon Cognito encounters an internal error.

Sourcemodule InvalidParameterException : sig ... end

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

Sourcemodule LimitExceededException : sig ... end

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

Sourcemodule NotAuthorizedException : sig ... end

This exception is thrown when a user isn't authorized.

Sourcemodule PasswordResetRequiredException : sig ... end

This exception is thrown when a password reset is required.

Sourcemodule ResourceNotFoundException : sig ... end

This exception is thrown when the Amazon Cognito service can't find the requested resource.

Sourcemodule TooManyRequestsException : sig ... end

This exception is thrown when the user has made too many requests for a given operation.

Sourcemodule UserNotConfirmedException : sig ... end

This exception is thrown when a user isn't confirmed successfully.

Sourcemodule UserNotFoundException : sig ... end

This exception is thrown when a user isn't found.

Sourcemodule ConfirmationCodeType : sig ... end

Sourcemodule EnableSoftwareTokenMFAException : sig ... end

This exception is thrown when there is a code mismatch and the service fails to configure the software token TOTP multi-factor authentication (MFA).

Sourcemodule InvalidUserPoolConfigurationException : sig ... end

This exception is thrown when the user pool configuration is not valid.

Sourcemodule SessionType : sig ... end

Sourcemodule SoftwareTokenMFANotFoundException : sig ... end

This exception is thrown when the software token time-based one-time password (TOTP) multi-factor authentication (MFA) isn't activated for the user pool.

Sourcemodule VerifySoftwareTokenResponseType : sig ... end

Sourcemodule SoftwareTokenMFAUserCodeType : sig ... end

Sourcemodule ConcurrentModificationException : sig ... end

This exception is thrown if two or more modifications are happening concurrently.

Sourcemodule FeatureUnavailableInTierException : sig ... end

This exception is thrown when a feature you attempted to configure isn't available in your current feature plan.

Sourcemodule InvalidEmailRoleAccessPolicyException : sig ... end

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

Sourcemodule InvalidSmsRoleAccessPolicyException : sig ... end

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

Sourcemodule InvalidSmsRoleTrustRelationshipException : sig ... end

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

Sourcemodule TierChangeNotAllowedException : sig ... end

This exception is thrown when you've attempted to change your feature plan but the operation isn't permitted.

Sourcemodule UserImportInProgressException : sig ... end

This exception is thrown when you're trying to modify a user pool while a user import job is in progress for that pool.

Sourcemodule UserPoolTaggingException : sig ... end

This exception is thrown when a user pool tag can't be set or updated.

Sourcemodule InvalidOAuthFlowException : sig ... end

This exception is thrown when the specified OAuth flow is not valid.

Sourcemodule ScopeDoesNotExistException : sig ... end

This exception is thrown when the specified scope doesn't exist.

Sourcemodule UserPoolClientType : sig ... end

The configuration of a user pool client.

Sourcemodule CodeDeliveryDetailsListType : sig ... end

Sourcemodule CodeDeliveryFailureException : sig ... end

This exception is thrown when a verification code fails to deliver successfully.

Sourcemodule InvalidLambdaResponseException : sig ... end

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

Sourcemodule UnexpectedLambdaException : sig ... end

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

Sourcemodule UserLambdaValidationException : sig ... end

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

Sourcemodule ClientMetadataType : sig ... end

Sourcemodule TermsExistsException : sig ... end

Terms document names must be unique to the app client. This exception is thrown when you attempt to create terms documents with a duplicate TermsName.

Sourcemodule TermsType : sig ... end

The details of a set of terms documents. For more information, see Terms documents.

Sourcemodule ManagedLoginBrandingType : sig ... end

A managed login branding style that's assigned to a user pool app client.

Sourcemodule IdentityProviderType : sig ... end

A user pool identity provider (IdP). Contains information about a third-party IdP to a user pool, the attributes that it populates to user profiles, and the trust relationship between the IdP and your user pool.

Sourcemodule UnsupportedIdentityProviderException : sig ... end

This exception is thrown when the specified identifier isn't supported.

Sourcemodule DeviceRememberedStatusType : sig ... end

Sourcemodule UserPoolAddOnNotEnabledException : sig ... end

This exception is thrown when user pool add-ons aren't enabled.

Sourcemodule EventIdType : sig ... end

Sourcemodule UserPoolTagsListType : sig ... end

Sourcemodule PreconditionNotMetException : sig ... end

This exception is thrown when a precondition is not met.

Sourcemodule WebAuthnConfigurationMissingException : sig ... end

This exception is thrown when a user pool doesn't have a configured relying party id or a user pool domain.

Sourcemodule WebAuthnNotEnabledException : sig ... end

This exception is thrown when the passkey feature isn't enabled for the user pool.

Sourcemodule InvalidPasswordException : sig ... end

This exception is thrown when Amazon Cognito encounters an invalid password.

Sourcemodule UsernameExistsException : sig ... end

This exception is thrown when Amazon Cognito encounters a user name that already exists in the user pool.

Sourcemodule AnalyticsMetadataType : sig ... end

Information that your application adds to authentication requests. Applies an endpoint ID to the analytics data that your user pool sends to Amazon Pinpoint. An endpoint ID uniquely identifies a mobile device, email address or phone number that can receive messages from Amazon Pinpoint analytics. For more information about Amazon Web Services Regions that can contain Amazon Pinpoint resources for use with Amazon Cognito user pools, see Using Amazon Pinpoint analytics with Amazon Cognito user pools.

Sourcemodule PasswordType : sig ... end

Sourcemodule SecretHashType : sig ... end

Sourcemodule UserContextDataType : sig ... end

Contextual data, such as the user's device fingerprint, IP address, or location, used for evaluating the risk of an unexpected event by Amazon Cognito threat protection.

Sourcemodule EmailMfaConfigType : sig ... end

Sets or shows configuration for user pool email message MFA and sign-in with one-time passwords (OTPs). Includes the subject and body of the email message template for sign-in and MFA messages. To activate this setting, your user pool must be in the Essentials tier or higher.

Sourcemodule SmsMfaConfigType : sig ... end

The configuration of multi-factor authentication (MFA) with SMS messages in a user pool.

Sourcemodule SoftwareTokenMfaConfigType : sig ... end

Settings for time-based one-time password (TOTP) multi-factor authentication (MFA) in a user pool. Enables and disables availability of this feature.

Sourcemodule WebAuthnConfigurationType : sig ... end

Settings for authentication (MFA) with passkey, or webauthN, biometric and security-key devices in a user pool. Configures the following: Configuration for requiring user-verification support in passkeys. The user pool relying-party ID. This is the domain, typically your user pool domain, that user's passkey providers should trust as a receiver of passkey authentication. The providers that you want to allow as origins for passkey authentication.

Sourcemodule EmailMfaSettingsType : sig ... end

User preferences for multi-factor authentication with email messages. Activates or deactivates email MFA and sets it as the preferred MFA method when multiple methods are available. To activate this setting, your user pool must be in the Essentials tier or higher.

Sourcemodule SMSMfaSettingsType : sig ... end

A user's preference for using SMS message multi-factor authentication (MFA). Turns SMS MFA on and off, and can set SMS as preferred when other MFA options are available. You can't turn off SMS MFA for any of your users when MFA is required in your user pool; you can only set the type that your user prefers.

Sourcemodule SoftwareTokenMfaSettingsType : sig ... end

A user's preference for using time-based one-time password (TOTP) multi-factor authentication (MFA). Turns TOTP MFA on and off, and can set TOTP as preferred when other MFA options are available. You can't turn off TOTP MFA for any of your users when MFA is required in your user pool; you can only set the type that your user prefers.

Sourcemodule WebAuthnMfaSettingsType : sig ... end

A user's preference for using passkey, or WebAuthn, multi-factor authentication (MFA). Turns passkey MFA on and off for the user. Unlike other MFA settings types, this type doesn't include a PreferredMfa option because passkey MFA applies only when passkey is the first authentication factor.

Sourcemodule UICustomizationType : sig ... end

A container for the UI customization information for the hosted UI in a user pool.

Sourcemodule ImageFileType : sig ... end

Sourcemodule RiskConfigurationType : sig ... end

The settings of risk configuration for threat protection with threat protection in a user pool.

Sourcemodule LogDeliveryConfigurationType : sig ... end

The logging parameters of a user pool, as returned in the response to a GetLogDeliveryConfiguration request.

Sourcemodule UnauthorizedException : sig ... end

Exception that is thrown when the request isn't authorized. This can happen due to an invalid access token in the request.

Sourcemodule UnsupportedOperationException : sig ... end

Exception that is thrown when you attempt to perform an operation that isn't enabled for the user pool client.

Sourcemodule UnsupportedTokenTypeException : sig ... end

Exception that is thrown when an unsupported token is passed to an operation.

Sourcemodule AuthenticationResultType : sig ... end

The object that your application receives after authentication. Contains tokens and information for device authentication.

Sourcemodule ChallengeParametersType : sig ... end

Sourcemodule MFAMethodNotFoundException : sig ... end

This exception is thrown when Amazon Cognito can't find a multi-factor authentication (MFA) method.

Sourcemodule PasswordHistoryPolicyViolationException : sig ... end

The message returned when a user's new password matches a previous password and doesn't comply with the password-history policy.

Sourcemodule ChallengeResponsesType : sig ... end

Sourcemodule PaginationKey : sig ... end

Sourcemodule WebAuthnCredentialDescriptionListType : sig ... end

Sourcemodule WebAuthnCredentialsQueryLimitType : sig ... end

Sourcemodule SearchPaginationTokenType : sig ... end

Sourcemodule UsersListType : sig ... end

Sourcemodule QueryLimitType : sig ... end

Sourcemodule SearchedAttributeNamesListType : sig ... end

Sourcemodule UserFilterType : sig ... end

Sourcemodule PaginationKeyType : sig ... end

Sourcemodule UserPoolListType : sig ... end

Sourcemodule PoolQueryLimitType : sig ... end

Sourcemodule UserPoolClientListType : sig ... end

Sourcemodule QueryLimit : sig ... end

Sourcemodule ClientSecretDescriptorListType : sig ... end

Sourcemodule InternalServerException : sig ... end

This exception is thrown when Amazon Cognito encounters an internal server error.

Sourcemodule UserImportJobsListType : sig ... end

Sourcemodule TermsDescriptionListType : sig ... end

Sourcemodule ListTermsRequestMaxResultsInteger : sig ... end

Sourcemodule ResourceServersListType : sig ... end

Sourcemodule ListResourceServersLimitType : sig ... end

Sourcemodule ProvidersListType : sig ... end

Sourcemodule ListProvidersLimitType : sig ... end

Sourcemodule GroupListType : sig ... end

Sourcemodule DeviceListType : sig ... end

Sourcemodule AvailableChallengeListType : sig ... end

Sourcemodule AuthFlowType : sig ... end

Sourcemodule AuthParametersType : sig ... end

Sourcemodule UserMFASettingListType : sig ... end

Sourcemodule ConfiguredUserAuthFactorsListType : sig ... end

Sourcemodule RefreshTokenReuseException : sig ... end

This exception is throw when your application requests token refresh with a refresh token that has been invalidated by refresh-token rotation.

Sourcemodule ListOfStringTypes : sig ... end

Sourcemodule UserPoolType : sig ... end

The configuration of a user pool.

Sourcemodule DomainDescriptionType : sig ... end

A container for information about the user pool domain associated with the hosted UI and OAuth endpoints.

Sourcemodule AttributeNameListType : sig ... end

Sourcemodule GenerateSecret : sig ... end

Sourcemodule ManagedLoginBrandingExistsException : sig ... end

This exception is thrown when you attempt to apply a managed login branding style to an app client that already has an assigned style.

Sourcemodule DuplicateProviderException : sig ... end

This exception is thrown when the provider is already supported by the user pool.

Sourcemodule ProviderNameTypeV2 : sig ... end

Sourcemodule GroupExistsException : sig ... end

This exception is thrown when Amazon Cognito encounters a group that already exists in the user pool.

Sourcemodule TooManyFailedAttemptsException : sig ... end

This exception is thrown when the user has made too many failed attempts for a given action, such as sign-in.

Sourcemodule ForceAliasCreation : sig ... end

Sourcemodule DeviceKeyExistsException : sig ... end

This exception is thrown when a user attempts to confirm a device with a device key that already exists.

Sourcemodule DeviceNameType : sig ... end

Sourcemodule DeviceSecretVerifierConfigType : sig ... end

A Secure Remote Password (SRP) value that your application generates when you register a user's device. For more information, see Getting a device key.

Sourcemodule WebAuthnChallengeNotFoundException : sig ... end

This exception is thrown when the challenge from StartWebAuthn registration has expired.

Sourcemodule WebAuthnClientMismatchException : sig ... end

This exception is thrown when the access token is for a different client than the one in the original StartWebAuthnRegistration request.

Sourcemodule WebAuthnCredentialNotSupportedException : sig ... end

This exception is thrown when a user presents passkey credentials from an unsupported device or provider.

Sourcemodule WebAuthnOriginNotAllowedException : sig ... end

This exception is thrown when the passkey credential's registration origin does not align with the user pool relying party id.

Sourcemodule WebAuthnRelyingPartyMismatchException : sig ... end

This exception is thrown when the given passkey credential is associated with a different relying party ID than the user pool relying party ID.

Sourcemodule SecretCodeType : sig ... end

Sourcemodule ContextDataType : sig ... end

Contextual user data used for evaluating the risk of an authentication event by user pool threat protection.

Sourcemodule AuthEventsType : sig ... end

Sourcemodule ProviderUserIdentifierType : sig ... end

The characteristics of a source or destination user for linking a federated user profile to a local user profile.

Sourcemodule UnsupportedUserStateException : sig ... end

The request failed because the user is in an unsupported state.

Sourcemodule DeliveryMediumListType : sig ... end

Sourcemodule MessageActionType : sig ... end

Sourcemodule AccessDeniedException : sig ... end

This exception is thrown when you don't have sufficient permissions to perform the requested operation.

Sourcemodule CustomAttributesListType : sig ... end

Sourcemodule VerifyUserAttributeResponse : sig ... end

A container representing the response from the server from the request to verify user attributes.

Sourcemodule VerifyUserAttributeRequest : sig ... end

Represents the request to verify user attributes.

Sourcemodule VerifySoftwareTokenResponse : sig ... end

Registers the current user's time-based one-time password (TOTP) authenticator with a code generated in their authenticator app from a private key that's supplied by your user pool. Marks the user's software token MFA status as "verified" if successful. The request takes an access token or a session string, but not both. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule VerifySoftwareTokenRequest : sig ... end

Registers the current user's time-based one-time password (TOTP) authenticator with a code generated in their authenticator app from a private key that's supplied by your user pool. Marks the user's software token MFA status as "verified" if successful. The request takes an access token or a session string, but not both. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule UpdateUserPoolResponse : sig ... end

Represents the response from the server when you make a request to update the user pool.

Sourcemodule UpdateUserPoolRequest : sig ... end

Represents the request to update the user pool.

Sourcemodule UpdateUserPoolDomainResponse : sig ... end

The UpdateUserPoolDomain response output.

Sourcemodule UpdateUserPoolDomainRequest : sig ... end

The UpdateUserPoolDomain request input.

Sourcemodule UpdateUserPoolClientResponse : sig ... end

Represents the response from the server to the request to update the user pool client.

Sourcemodule UpdateUserPoolClientRequest : sig ... end

Represents the request to update the user pool client.

Sourcemodule UpdateUserAttributesResponse : sig ... end

Represents the response from the server for the request to update user attributes.

Sourcemodule UpdateUserAttributesRequest : sig ... end

Represents the request to update user attributes.

Sourcemodule UpdateTermsResponse : sig ... end

Modifies existing terms documents for the requested app client. When Terms and conditions and Privacy policy documents are configured, the app client displays links to them in the sign-up page of managed login for the app client. You can provide URLs for terms documents in the languages that are supported by managed login localization. Amazon Cognito directs users to the terms documents for their current language, with fallback to default if no document exists for the language. Each request accepts one type of terms document and a map of language-to-link for that document type. You must provide both types of terms documents in at least one language before Amazon Cognito displays your terms documents. Supply each type in separate requests. For more information, see Terms documents. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateTermsRequest : sig ... end

Modifies existing terms documents for the requested app client. When Terms and conditions and Privacy policy documents are configured, the app client displays links to them in the sign-up page of managed login for the app client. You can provide URLs for terms documents in the languages that are supported by managed login localization. Amazon Cognito directs users to the terms documents for their current language, with fallback to default if no document exists for the language. Each request accepts one type of terms document and a map of language-to-link for that document type. You must provide both types of terms documents in at least one language before Amazon Cognito displays your terms documents. Supply each type in separate requests. For more information, see Terms documents. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateResourceServerResponse : sig ... end

Updates the name and scopes of a resource server. All other fields are read-only. For more information about resource servers, see Access control with resource servers. If you don't provide a value for an attribute, it is set to the default value. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateResourceServerRequest : sig ... end

Updates the name and scopes of a resource server. All other fields are read-only. For more information about resource servers, see Access control with resource servers. If you don't provide a value for an attribute, it is set to the default value. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateManagedLoginBrandingResponse : sig ... end

Configures the branding settings for a user pool style. This operation is the programmatic option for the configuration of a style in the branding editor. Provides values for UI customization in a Settings JSON object and image files in an Assets array. This operation has a 2-megabyte request-size limit and include the CSS settings and image assets for your app client. Your branding settings might exceed 2MB in size. Amazon Cognito doesn't require that you pass all parameters in one request and preserves existing style settings that you don't specify. If your request is larger than 2MB, separate it into multiple requests, each with a size smaller than the limit. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateManagedLoginBrandingRequest : sig ... end

Configures the branding settings for a user pool style. This operation is the programmatic option for the configuration of a style in the branding editor. Provides values for UI customization in a Settings JSON object and image files in an Assets array. This operation has a 2-megabyte request-size limit and include the CSS settings and image assets for your app client. Your branding settings might exceed 2MB in size. Amazon Cognito doesn't require that you pass all parameters in one request and preserves existing style settings that you don't specify. If your request is larger than 2MB, separate it into multiple requests, each with a size smaller than the limit. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateIdentityProviderResponse : sig ... end

Modifies the configuration and trust relationship between a third-party identity provider (IdP) and a user pool. Amazon Cognito accepts sign-in with third-party identity providers through managed login and OIDC relying-party libraries. For more information, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateIdentityProviderRequest : sig ... end

Modifies the configuration and trust relationship between a third-party identity provider (IdP) and a user pool. Amazon Cognito accepts sign-in with third-party identity providers through managed login and OIDC relying-party libraries. For more information, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateGroupResponse : sig ... end

Given the name of a user pool group, updates any of the properties for precedence, IAM role, or description. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateGroupRequest : sig ... end

Given the name of a user pool group, updates any of the properties for precedence, IAM role, or description. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule UpdateDeviceStatusResponse : sig ... end

The response to the request to update the device status.

Sourcemodule UpdateDeviceStatusRequest : sig ... end

Represents the request to update the device status.

Sourcemodule UpdateAuthEventFeedbackResponse : sig ... end

Provides the feedback for an authentication event generated by threat protection features. The user's response indicates that you think that the event either was from a valid user or was an unwanted authentication attempt. This feedback improves the risk evaluation decision for the user pool as part of Amazon Cognito threat protection. To activate this setting, your user pool must be on the Plus tier. This operation requires a FeedbackToken that Amazon Cognito generates and adds to notification emails when users have potentially suspicious authentication events. Users invoke this operation when they select the link that corresponds to {one-click-link-valid} or {one-click-link-invalid} in your notification template. Because FeedbackToken is a required parameter, you can't make requests to UpdateAuthEventFeedback without the contents of the notification email message. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule UpdateAuthEventFeedbackRequest : sig ... end

Provides the feedback for an authentication event generated by threat protection features. The user's response indicates that you think that the event either was from a valid user or was an unwanted authentication attempt. This feedback improves the risk evaluation decision for the user pool as part of Amazon Cognito threat protection. To activate this setting, your user pool must be on the Plus tier. This operation requires a FeedbackToken that Amazon Cognito generates and adds to notification emails when users have potentially suspicious authentication events. Users invoke this operation when they select the link that corresponds to {one-click-link-valid} or {one-click-link-invalid} in your notification template. Because FeedbackToken is a required parameter, you can't make requests to UpdateAuthEventFeedback without the contents of the notification email message. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule UntagResourceResponse : sig ... end

Given tag IDs that you previously assigned to a user pool, removes them.

Sourcemodule UntagResourceRequest : sig ... end

Given tag IDs that you previously assigned to a user pool, removes them.

Sourcemodule TagResourceResponse : sig ... end

Assigns a set of tags to an Amazon Cognito user pool. A tag is a label that you can use to categorize and manage user pools in different ways, such as by purpose, owner, environment, or other criteria. Each tag consists of a key and value, both of which you define. A key is a general category for more specific values. For example, if you have two versions of a user pool, one for testing and another for production, you might assign an Environment tag key to both user pools. The value of this key might be Test for one user pool, and Production for the other. Tags are useful for cost tracking and access control. You can activate your tags so that they appear on the Billing and Cost Management console, where you can track the costs associated with your user pools. In an Identity and Access Management policy, you can constrain permissions for user pools based on specific tags or tag values. You can use this action up to 5 times per second, per account. A user pool can have as many as 50 tags.

Sourcemodule TagResourceRequest : sig ... end

Assigns a set of tags to an Amazon Cognito user pool. A tag is a label that you can use to categorize and manage user pools in different ways, such as by purpose, owner, environment, or other criteria. Each tag consists of a key and value, both of which you define. A key is a general category for more specific values. For example, if you have two versions of a user pool, one for testing and another for production, you might assign an Environment tag key to both user pools. The value of this key might be Test for one user pool, and Production for the other. Tags are useful for cost tracking and access control. You can activate your tags so that they appear on the Billing and Cost Management console, where you can track the costs associated with your user pools. In an Identity and Access Management policy, you can constrain permissions for user pools based on specific tags or tag values. You can use this action up to 5 times per second, per account. A user pool can have as many as 50 tags.

Sourcemodule StopUserImportJobResponse : sig ... end

Represents the response from the server to the request to stop the user import job.

Sourcemodule StopUserImportJobRequest : sig ... end

Represents the request to stop the user import job.

Sourcemodule StartWebAuthnRegistrationResponse : sig ... end

Requests credential creation options from your user pool for the currently signed-in user. Returns information about the user pool, the user profile, and authentication requirements. Users must provide this information in their request to enroll your application with their passkey provider. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Sourcemodule StartWebAuthnRegistrationRequest : sig ... end

Requests credential creation options from your user pool for the currently signed-in user. Returns information about the user pool, the user profile, and authentication requirements. Users must provide this information in their request to enroll your application with their passkey provider. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Sourcemodule StartUserImportJobResponse : sig ... end

Represents the response from the server to the request to start the user import job.

Sourcemodule StartUserImportJobRequest : sig ... end

Represents the request to start the user import job.

Sourcemodule SignUpResponse : sig ... end

The response from the server for a registration request.

Sourcemodule SignUpRequest : sig ... end

Represents the request to register a user.

Sourcemodule SetUserSettingsResponse : sig ... end

The response from the server for a set user settings request.

Sourcemodule SetUserSettingsRequest : sig ... end

Represents the request to set user settings.

Sourcemodule SetUserPoolMfaConfigResponse : sig ... end

Sets user pool multi-factor authentication (MFA) and passkey configuration. For more information about user pool MFA, see Adding MFA. For more information about WebAuthn passkeys see Authentication flows. This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers require you to register an origination phone number before you can send SMS messages to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a phone number with Amazon Pinpoint. Amazon Cognito uses the registered number automatically. Otherwise, Amazon Cognito users who must receive SMS messages might not be able to sign up, activate their accounts, or sign in. If you have never used SMS text messages with Amazon Cognito or any other Amazon Web Services service, Amazon Simple Notification Service might place your account in the SMS sandbox. In sandbox mode , you can send messages only to verified phone numbers. After you test your app while in the sandbox environment, you can move out of the sandbox and into production. For more information, see SMS message settings for Amazon Cognito user pools in the Amazon Cognito Developer Guide.

Sourcemodule SetUserPoolMfaConfigRequest : sig ... end

Sets user pool multi-factor authentication (MFA) and passkey configuration. For more information about user pool MFA, see Adding MFA. For more information about WebAuthn passkeys see Authentication flows. This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers require you to register an origination phone number before you can send SMS messages to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a phone number with Amazon Pinpoint. Amazon Cognito uses the registered number automatically. Otherwise, Amazon Cognito users who must receive SMS messages might not be able to sign up, activate their accounts, or sign in. If you have never used SMS text messages with Amazon Cognito or any other Amazon Web Services service, Amazon Simple Notification Service might place your account in the SMS sandbox. In sandbox mode , you can send messages only to verified phone numbers. After you test your app while in the sandbox environment, you can move out of the sandbox and into production. For more information, see SMS message settings for Amazon Cognito user pools in the Amazon Cognito Developer Guide.

Sourcemodule SetUserMFAPreferenceResponse : sig ... end

Set the user's multi-factor authentication (MFA) method preference, including which MFA factors are activated and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in. If an MFA type is activated for a user, the user will be prompted for MFA during all sign-in attempts unless device tracking is turned on and the device has been trusted. If you want MFA to be applied selectively based on the assessed risk level of sign-in attempts, deactivate MFA for users and turn on Adaptive Authentication for the user pool. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule SetUserMFAPreferenceRequest : sig ... end

Set the user's multi-factor authentication (MFA) method preference, including which MFA factors are activated and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in. If an MFA type is activated for a user, the user will be prompted for MFA during all sign-in attempts unless device tracking is turned on and the device has been trusted. If you want MFA to be applied selectively based on the assessed risk level of sign-in attempts, deactivate MFA for users and turn on Adaptive Authentication for the user pool. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule SetUICustomizationResponse : sig ... end

Configures UI branding settings for domains with the hosted UI (classic) branding version. Your user pool must have a domain. Configure a domain with . Set the default configuration for all clients with a ClientId of ALL. When the ClientId value is an app client ID, the settings you pass in this request apply to that app client and override the default ALL configuration. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule SetUICustomizationRequest : sig ... end

Configures UI branding settings for domains with the hosted UI (classic) branding version. Your user pool must have a domain. Configure a domain with . Set the default configuration for all clients with a ClientId of ALL. When the ClientId value is an app client ID, the settings you pass in this request apply to that app client and override the default ALL configuration. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule SetRiskConfigurationResponse : sig ... end

Configures threat protection for a user pool or app client. Sets configuration for the following. Responses to risks with adaptive authentication Responses to vulnerable passwords with compromised-credentials detection Notifications to users who have had risky activity detected IP-address denylist and allowlist To set the risk configuration for the user pool to defaults, send this request with only the UserPoolId parameter. To reset the threat protection settings of an app client to be inherited from the user pool, send UserPoolId and ClientId parameters only. To change threat protection to audit-only or off, update the value of UserPoolAddOns in an UpdateUserPool request. To activate this setting, your user pool must be on the Plus tier.

Sourcemodule SetRiskConfigurationRequest : sig ... end

Configures threat protection for a user pool or app client. Sets configuration for the following. Responses to risks with adaptive authentication Responses to vulnerable passwords with compromised-credentials detection Notifications to users who have had risky activity detected IP-address denylist and allowlist To set the risk configuration for the user pool to defaults, send this request with only the UserPoolId parameter. To reset the threat protection settings of an app client to be inherited from the user pool, send UserPoolId and ClientId parameters only. To change threat protection to audit-only or off, update the value of UserPoolAddOns in an UpdateUserPool request. To activate this setting, your user pool must be on the Plus tier.

Sourcemodule SetLogDeliveryConfigurationResponse : sig ... end

Sets up or modifies the logging configuration of a user pool. User pools can export user notification logs and, when threat protection is active, user-activity logs. For more information, see Exporting user pool logs.

Sourcemodule SetLogDeliveryConfigurationRequest : sig ... end

Sets up or modifies the logging configuration of a user pool. User pools can export user notification logs and, when threat protection is active, user-activity logs. For more information, see Exporting user pool logs.

Sourcemodule RevokeTokenResponse : sig ... end

Revokes all of the access tokens generated by, and at the same time as, the specified refresh token. After a token is revoked, you can't use the revoked token to access Amazon Cognito user APIs, or to authorize access to your resource server. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule RevokeTokenRequest : sig ... end

Revokes all of the access tokens generated by, and at the same time as, the specified refresh token. After a token is revoked, you can't use the revoked token to access Amazon Cognito user APIs, or to authorize access to your resource server. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule RespondToAuthChallengeResponse : sig ... end

The response to respond to the authentication challenge.

Sourcemodule RespondToAuthChallengeRequest : sig ... end

The request to respond to an authentication challenge.

Sourcemodule ResendConfirmationCodeResponse : sig ... end

The response from the server when Amazon Cognito makes the request to resend a confirmation code.

Sourcemodule ResendConfirmationCodeRequest : sig ... end

Represents the request to resend the confirmation code.

Sourcemodule ListWebAuthnCredentialsResponse : sig ... end

Generates a list of the currently signed-in user's registered passkey, or WebAuthn, credentials. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule ListWebAuthnCredentialsRequest : sig ... end

Generates a list of the currently signed-in user's registered passkey, or WebAuthn, credentials. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule ListUsersResponse : sig ... end

The response from the request to list users.

Sourcemodule ListUsersRequest : sig ... end

Represents the request to list users.

Sourcemodule ListUsersInGroupResponse : sig ... end

Given a user pool ID and a group name, returns a list of users in the group. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListUsersInGroupRequest : sig ... end

Given a user pool ID and a group name, returns a list of users in the group. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListUserPoolsResponse : sig ... end

Represents the response to list user pools.

Sourcemodule ListUserPoolsRequest : sig ... end

Represents the request to list user pools.

Sourcemodule ListUserPoolClientsResponse : sig ... end

Represents the response from the server that lists user pool clients.

Sourcemodule ListUserPoolClientsRequest : sig ... end

Represents the request to list the user pool clients.

Sourcemodule ListUserPoolClientSecretsResponse : sig ... end

The response containing the list of client secret metadata. This response does not include a NextToken field as all secrets are returned in a single response.

Sourcemodule ListUserPoolClientSecretsRequest : sig ... end

The request to list client secrets for a user pool app client.

Sourcemodule ListUserImportJobsResponse : sig ... end

Represents the response from the server to the request to list the user import jobs.

Sourcemodule ListUserImportJobsRequest : sig ... end

Represents the request to list the user import jobs.

Sourcemodule ListTermsResponse : sig ... end

Returns details about all terms documents for the requested user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListTermsRequest : sig ... end

Returns details about all terms documents for the requested user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListTagsForResourceResponse : sig ... end

Lists the tags that are assigned to an Amazon Cognito user pool. For more information, see Tagging resources.

Sourcemodule ListTagsForResourceRequest : sig ... end

Lists the tags that are assigned to an Amazon Cognito user pool. For more information, see Tagging resources.

Sourcemodule ListResourceServersResponse : sig ... end

Given a user pool ID, returns all resource servers and their details. For more information about resource servers, see Access control with resource servers. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListResourceServersRequest : sig ... end

Given a user pool ID, returns all resource servers and their details. For more information about resource servers, see Access control with resource servers. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListIdentityProvidersResponse : sig ... end

Given a user pool ID, returns information about configured identity providers (IdPs). For more information about IdPs, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListIdentityProvidersRequest : sig ... end

Given a user pool ID, returns information about configured identity providers (IdPs). For more information about IdPs, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListGroupsResponse : sig ... end

Given a user pool ID, returns user pool groups and their details. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListGroupsRequest : sig ... end

Given a user pool ID, returns user pool groups and their details. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ListDevicesResponse : sig ... end

Represents the response to list devices.

Sourcemodule ListDevicesRequest : sig ... end

Represents the request to list the devices.

Sourcemodule InitiateAuthResponse : sig ... end

Initiates the authentication response.

Sourcemodule InitiateAuthRequest : sig ... end

Initiates the authentication request.

Sourcemodule GlobalSignOutResponse : sig ... end

The response to the request to sign out all devices.

Sourcemodule GlobalSignOutRequest : sig ... end

Represents the request to sign out all devices.

Sourcemodule GetUserResponse : sig ... end

Represents the response from the server from the request to get information about the user.

Sourcemodule GetUserRequest : sig ... end

Represents the request to get information about the user.

Sourcemodule GetUserPoolMfaConfigResponse : sig ... end

Given a user pool ID, returns configuration for sign-in with WebAuthn authenticators and for multi-factor authentication (MFA). This operation describes the following: The WebAuthn relying party (RP) ID and user-verification settings. The required, optional, or disabled state of MFA for all user pool users. The message templates for email and SMS MFA. The enabled or disabled state of time-based one-time password (TOTP) MFA. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule GetUserPoolMfaConfigRequest : sig ... end

Given a user pool ID, returns configuration for sign-in with WebAuthn authenticators and for multi-factor authentication (MFA). This operation describes the following: The WebAuthn relying party (RP) ID and user-verification settings. The required, optional, or disabled state of MFA for all user pool users. The message templates for email and SMS MFA. The enabled or disabled state of time-based one-time password (TOTP) MFA. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule GetUserAuthFactorsResponse : sig ... end

Lists the authentication options for the currently signed-in user. Returns the following: The user's multi-factor authentication (MFA) preferences. The user's options for choice-based authentication with the USER_AUTH flow. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule GetUserAuthFactorsRequest : sig ... end

Lists the authentication options for the currently signed-in user. Returns the following: The user's multi-factor authentication (MFA) preferences. The user's options for choice-based authentication with the USER_AUTH flow. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule GetUserAttributeVerificationCodeResponse : sig ... end

The verification code response returned by the server response to get the user attribute verification code.

Sourcemodule GetUserAttributeVerificationCodeRequest : sig ... end

Represents the request to get user attribute verification.

Sourcemodule GetUICustomizationResponse : sig ... end

Given a user pool ID or app client, returns information about classic hosted UI branding that you applied, if any. Returns user-pool level branding information if no app client branding is applied, or if you don't specify an app client ID. Returns an empty object if you haven't applied hosted UI branding to either the client or the user pool. For more information, see Hosted UI (classic) branding.

Sourcemodule GetUICustomizationRequest : sig ... end

Given a user pool ID or app client, returns information about classic hosted UI branding that you applied, if any. Returns user-pool level branding information if no app client branding is applied, or if you don't specify an app client ID. Returns an empty object if you haven't applied hosted UI branding to either the client or the user pool. For more information, see Hosted UI (classic) branding.

Sourcemodule GetTokensFromRefreshTokenResponse : sig ... end

Given a refresh token, issues new ID, access, and optionally refresh tokens for the user who owns the submitted token. This operation issues a new refresh token and invalidates the original refresh token after an optional grace period when refresh token rotation is enabled. If refresh token rotation is disabled, issues new ID and access tokens only.

Sourcemodule GetTokensFromRefreshTokenRequest : sig ... end

Given a refresh token, issues new ID, access, and optionally refresh tokens for the user who owns the submitted token. This operation issues a new refresh token and invalidates the original refresh token after an optional grace period when refresh token rotation is enabled. If refresh token rotation is disabled, issues new ID and access tokens only.

Sourcemodule GetSigningCertificateResponse : sig ... end

Response from Amazon Cognito for a signing certificate request.

Sourcemodule GetSigningCertificateRequest : sig ... end

Request to get a signing certificate from Amazon Cognito.

Sourcemodule GetLogDeliveryConfigurationResponse : sig ... end

Given a user pool ID, returns the logging configuration. User pools can export message-delivery error and threat-protection activity logs to external Amazon Web Services services. For more information, see Exporting user pool logs. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule GetLogDeliveryConfigurationRequest : sig ... end

Given a user pool ID, returns the logging configuration. User pools can export message-delivery error and threat-protection activity logs to external Amazon Web Services services. For more information, see Exporting user pool logs. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule GetIdentityProviderByIdentifierResponse : sig ... end

Given the identifier of an identity provider (IdP), for example examplecorp, returns information about the user pool configuration for that IdP. For more information about IdPs, see Third-party IdP sign-in.

Sourcemodule GetIdentityProviderByIdentifierRequest : sig ... end

Given the identifier of an identity provider (IdP), for example examplecorp, returns information about the user pool configuration for that IdP. For more information about IdPs, see Third-party IdP sign-in.

Sourcemodule GetGroupResponse : sig ... end

Given a user pool ID and a group name, returns information about the user group. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule GetGroupRequest : sig ... end

Given a user pool ID and a group name, returns information about the user group. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule GetDeviceResponse : sig ... end

Gets the device response.

Sourcemodule GetDeviceRequest : sig ... end

Represents the request to get the device.

Sourcemodule GetCSVHeaderResponse : sig ... end

Represents the response from the server to the request to get the header information of the CSV file for the user import job.

Sourcemodule GetCSVHeaderRequest : sig ... end

Represents the request to get the header information of the CSV file for the user import job.

Sourcemodule ForgotPasswordResponse : sig ... end

The response from Amazon Cognito to a request to reset a password.

Sourcemodule ForgotPasswordRequest : sig ... end

Represents the request to reset a user's password.

Sourcemodule ForgetDeviceRequest : sig ... end

Represents the request to forget the device.

Sourcemodule DescribeUserPoolResponse : sig ... end

Represents the response to describe the user pool.

Sourcemodule DescribeUserPoolRequest : sig ... end

Represents the request to describe the user pool.

Sourcemodule DescribeUserPoolDomainResponse : sig ... end

Given a user pool domain name, returns information about the domain configuration. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DescribeUserPoolDomainRequest : sig ... end

Given a user pool domain name, returns information about the domain configuration. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DescribeUserPoolClientResponse : sig ... end

Represents the response from the server from a request to describe the user pool client.

Sourcemodule DescribeUserPoolClientRequest : sig ... end

Represents the request to describe a user pool client.

Sourcemodule DescribeUserImportJobResponse : sig ... end

Represents the response from the server to the request to describe the user import job.

Sourcemodule DescribeUserImportJobRequest : sig ... end

Represents the request to describe the user import job.

Sourcemodule DescribeTermsResponse : sig ... end

Returns details for the requested terms documents ID. For more information, see Terms documents. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DescribeTermsRequest : sig ... end

Returns details for the requested terms documents ID. For more information, see Terms documents. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DescribeRiskConfigurationResponse : sig ... end

Given an app client or user pool ID where threat protection is configured, describes the risk configuration. This operation returns details about adaptive authentication, compromised credentials, and IP-address allow- and denylists. For more information about threat protection, see Threat protection.

Sourcemodule DescribeRiskConfigurationRequest : sig ... end

Given an app client or user pool ID where threat protection is configured, describes the risk configuration. This operation returns details about adaptive authentication, compromised credentials, and IP-address allow- and denylists. For more information about threat protection, see Threat protection.

Sourcemodule DescribeResourceServerResponse : sig ... end

Describes a resource server. For more information about resource servers, see Access control with resource servers.

Sourcemodule DescribeResourceServerRequest : sig ... end

Describes a resource server. For more information about resource servers, see Access control with resource servers.

Sourcemodule DescribeManagedLoginBrandingResponse : sig ... end

Given the ID of a managed login branding style, returns detailed information about the style.

Sourcemodule DescribeManagedLoginBrandingRequest : sig ... end

Given the ID of a managed login branding style, returns detailed information about the style.

Sourcemodule DescribeManagedLoginBrandingByClientResponse : sig ... end

Given the ID of a user pool app client, returns detailed information about the style assigned to the app client.

Sourcemodule DescribeManagedLoginBrandingByClientRequest : sig ... end

Given the ID of a user pool app client, returns detailed information about the style assigned to the app client.

Sourcemodule DescribeIdentityProviderResponse : sig ... end

Given a user pool ID and identity provider (IdP) name, returns details about the IdP.

Sourcemodule DescribeIdentityProviderRequest : sig ... end

Given a user pool ID and identity provider (IdP) name, returns details about the IdP.

Sourcemodule DeleteWebAuthnCredentialResponse : sig ... end

Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule DeleteWebAuthnCredentialRequest : sig ... end

Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.

Sourcemodule DeleteUserRequest : sig ... end

Represents the request to delete a user.

Sourcemodule DeleteUserPoolRequest : sig ... end

Represents the request to delete a user pool.

Sourcemodule DeleteUserPoolDomainResponse : sig ... end

Given a user pool ID and domain identifier, deletes a user pool domain. After you delete a user pool domain, your managed login pages and authorization server are no longer available.

Sourcemodule DeleteUserPoolDomainRequest : sig ... end

Given a user pool ID and domain identifier, deletes a user pool domain. After you delete a user pool domain, your managed login pages and authorization server are no longer available.

Sourcemodule DeleteUserPoolClientSecretResponse : sig ... end

The response from deleting a client secret.

Sourcemodule DeleteUserPoolClientSecretRequest : sig ... end

The request to delete a specific client secret from a user pool app client.

Sourcemodule DeleteUserPoolClientRequest : sig ... end

Represents the request to delete a user pool client.

Sourcemodule DeleteUserAttributesResponse : sig ... end

Represents the response from the server to delete user attributes.

Sourcemodule DeleteUserAttributesRequest : sig ... end

Represents the request to delete user attributes.

Sourcemodule DeleteTermsRequest : sig ... end

Deletes the terms documents with the requested ID from your app client. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DeleteResourceServerRequest : sig ... end

Deletes a resource server. After you delete a resource server, users can no longer generate access tokens with scopes that are associate with that resource server. Resource servers are associated with custom scopes and machine-to-machine (M2M) authorization. For more information, see Access control with resource servers. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DeleteManagedLoginBrandingRequest : sig ... end

Deletes a managed login branding style. When you delete a style, you delete the branding association for an app client. When an app client doesn't have a style assigned, your managed login pages for that app client are nonfunctional until you create a new style or switch the domain branding version. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DeleteIdentityProviderRequest : sig ... end

Deletes a user pool identity provider (IdP). After you delete an IdP, users can no longer sign in to your user pool through that IdP. For more information about user pool IdPs, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule DeleteGroupRequest : sig ... end

Deletes a group from the specified user pool. When you delete a group, that group no longer contributes to users' cognito:preferred_group or cognito:groups claims, and no longer influence access-control decision that are based on group membership. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateUserPoolResponse : sig ... end

Represents the response from the server for the request to create a user pool.

Sourcemodule CreateUserPoolRequest : sig ... end

Represents the request to create a user pool.

Sourcemodule CreateUserPoolDomainResponse : sig ... end

A user pool domain hosts managed login, an authorization server and web server for authentication in your application. This operation creates a new user pool prefix domain or custom domain and sets the managed login branding version. Set the branding version to 1 for hosted UI (classic) or 2 for managed login. When you choose a custom domain, you must provide an SSL certificate in the US East (N. Virginia) Amazon Web Services Region in your request. Your prefix domain might take up to one minute to take effect. Your custom domain is online within five minutes, but it can take up to one hour to distribute your SSL certificate. For more information about adding a custom domain to your user pool, see Configuring a user pool domain. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateUserPoolDomainRequest : sig ... end

A user pool domain hosts managed login, an authorization server and web server for authentication in your application. This operation creates a new user pool prefix domain or custom domain and sets the managed login branding version. Set the branding version to 1 for hosted UI (classic) or 2 for managed login. When you choose a custom domain, you must provide an SSL certificate in the US East (N. Virginia) Amazon Web Services Region in your request. Your prefix domain might take up to one minute to take effect. Your custom domain is online within five minutes, but it can take up to one hour to distribute your SSL certificate. For more information about adding a custom domain to your user pool, see Configuring a user pool domain. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateUserPoolClientResponse : sig ... end

Represents the response from the server to create a user pool client.

Sourcemodule CreateUserPoolClientRequest : sig ... end

Represents the request to create a user pool client.

Sourcemodule CreateUserImportJobResponse : sig ... end

Represents the response from the server to the request to create the user import job.

Sourcemodule CreateUserImportJobRequest : sig ... end

Represents the request to create the user import job.

Sourcemodule CreateTermsResponse : sig ... end

Creates terms documents for the requested app client. When Terms and conditions and Privacy policy documents are configured, the app client displays links to them in the sign-up page of managed login for the app client. You can provide URLs for terms documents in the languages that are supported by managed login localization. Amazon Cognito directs users to the terms documents for their current language, with fallback to default if no document exists for the language. Each request accepts one type of terms document and a map of language-to-link for that document type. You must provide both types of terms documents in at least one language before Amazon Cognito displays your terms documents. Supply each type in separate requests. For more information, see Terms documents. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateTermsRequest : sig ... end

Creates terms documents for the requested app client. When Terms and conditions and Privacy policy documents are configured, the app client displays links to them in the sign-up page of managed login for the app client. You can provide URLs for terms documents in the languages that are supported by managed login localization. Amazon Cognito directs users to the terms documents for their current language, with fallback to default if no document exists for the language. Each request accepts one type of terms document and a map of language-to-link for that document type. You must provide both types of terms documents in at least one language before Amazon Cognito displays your terms documents. Supply each type in separate requests. For more information, see Terms documents. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateResourceServerResponse : sig ... end

Creates a new OAuth2.0 resource server and defines custom scopes within it. Resource servers are associated with custom scopes and machine-to-machine (M2M) authorization. For more information, see Access control with resource servers. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateResourceServerRequest : sig ... end

Creates a new OAuth2.0 resource server and defines custom scopes within it. Resource servers are associated with custom scopes and machine-to-machine (M2M) authorization. For more information, see Access control with resource servers. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateManagedLoginBrandingResponse : sig ... end

Creates a new set of branding settings for a user pool style and associates it with an app client. This operation is the programmatic option for the creation of a new style in the branding editor. Provides values for UI customization in a Settings JSON object and image files in an Assets array. To send the JSON object Document type parameter in Settings, you might need to update to the most recent version of your Amazon Web Services SDK. To create a new style with default settings, set UseCognitoProvidedValues to true and don't provide values for any other options. This operation has a 2-megabyte request-size limit and include the CSS settings and image assets for your app client. Your branding settings might exceed 2MB in size. Amazon Cognito doesn't require that you pass all parameters in one request and preserves existing style settings that you don't specify. If your request is larger than 2MB, separate it into multiple requests, each with a size smaller than the limit. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateManagedLoginBrandingRequest : sig ... end

Creates a new set of branding settings for a user pool style and associates it with an app client. This operation is the programmatic option for the creation of a new style in the branding editor. Provides values for UI customization in a Settings JSON object and image files in an Assets array. To send the JSON object Document type parameter in Settings, you might need to update to the most recent version of your Amazon Web Services SDK. To create a new style with default settings, set UseCognitoProvidedValues to true and don't provide values for any other options. This operation has a 2-megabyte request-size limit and include the CSS settings and image assets for your app client. Your branding settings might exceed 2MB in size. Amazon Cognito doesn't require that you pass all parameters in one request and preserves existing style settings that you don't specify. If your request is larger than 2MB, separate it into multiple requests, each with a size smaller than the limit. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateIdentityProviderResponse : sig ... end

Adds a configuration and trust relationship between a third-party identity provider (IdP) and a user pool. Amazon Cognito accepts sign-in with third-party identity providers through managed login and OIDC relying-party libraries. For more information, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateIdentityProviderRequest : sig ... end

Adds a configuration and trust relationship between a third-party identity provider (IdP) and a user pool. Amazon Cognito accepts sign-in with third-party identity providers through managed login and OIDC relying-party libraries. For more information, see Third-party IdP sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateGroupResponse : sig ... end

Creates a new group in the specified user pool. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule CreateGroupRequest : sig ... end

Creates a new group in the specified user pool. For more information about user pool groups, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule ConfirmSignUpResponse : sig ... end

Represents the response from the server for the registration confirmation.

Sourcemodule ConfirmSignUpRequest : sig ... end

Represents the request to confirm registration of a user.

Sourcemodule ConfirmForgotPasswordResponse : sig ... end

The response from the server that results from a user's request to retrieve a forgotten password.

Sourcemodule ConfirmForgotPasswordRequest : sig ... end

The request representing the confirmation for a password reset.

Sourcemodule ConfirmDeviceResponse : sig ... end

The confirm-device response.

Sourcemodule ConfirmDeviceRequest : sig ... end

The confirm-device request.

Sourcemodule CompleteWebAuthnRegistrationResponse : sig ... end

Completes registration of a passkey authenticator for the currently signed-in user. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Sourcemodule CompleteWebAuthnRegistrationRequest : sig ... end

Completes registration of a passkey authenticator for the currently signed-in user. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Sourcemodule ChangePasswordResponse : sig ... end

The response from the server to the change password request.

Sourcemodule ChangePasswordRequest : sig ... end

Represents the request to change a user password.

Sourcemodule AssociateSoftwareTokenResponse : sig ... end

Begins setup of time-based one-time password (TOTP) multi-factor authentication (MFA) for a user, with a unique private key that Amazon Cognito generates and returns in the API response. You can authorize an AssociateSoftwareToken request with either the user's access token, or a session string from a challenge response that you received from Amazon Cognito. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Sourcemodule AssociateSoftwareTokenRequest : sig ... end

Begins setup of time-based one-time password (TOTP) multi-factor authentication (MFA) for a user, with a unique private key that Amazon Cognito generates and returns in the API response. You can authorize an AssociateSoftwareToken request with either the user's access token, or a session string from a challenge response that you received from Amazon Cognito. Amazon Cognito doesn't evaluate Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Sourcemodule AdminUserGlobalSignOutResponse : sig ... end

The global sign-out response, as an administrator.

Sourcemodule AdminUserGlobalSignOutRequest : sig ... end

The request to sign out of all devices, as an administrator.

Sourcemodule AdminUpdateUserAttributesResponse : sig ... end

Represents the response from the server for the request to update user attributes as an administrator.

Sourcemodule AdminUpdateUserAttributesRequest : sig ... end

Represents the request to update the user's attributes as an administrator.

Sourcemodule AdminUpdateDeviceStatusResponse : sig ... end

The status response to the request to update the device, as an administrator.

Sourcemodule AdminUpdateDeviceStatusRequest : sig ... end

The request to update the device status, as an administrator.

Sourcemodule AdminUpdateAuthEventFeedbackResponse : sig ... end

Provides the feedback for an authentication event generated by threat protection features. Your response indicates that you think that the event either was from a valid user or was an unwanted authentication attempt. This feedback improves the risk evaluation decision for the user pool as part of Amazon Cognito threat protection. To activate this setting, your user pool must be on the Plus tier. To train the threat-protection model to recognize trusted and untrusted sign-in characteristics, configure threat protection in audit-only mode and provide a mechanism for users or administrators to submit feedback. Your feedback can tell Amazon Cognito that a risk rating was assigned at a level you don't agree with. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminUpdateAuthEventFeedbackRequest : sig ... end

Provides the feedback for an authentication event generated by threat protection features. Your response indicates that you think that the event either was from a valid user or was an unwanted authentication attempt. This feedback improves the risk evaluation decision for the user pool as part of Amazon Cognito threat protection. To activate this setting, your user pool must be on the Plus tier. To train the threat-protection model to recognize trusted and untrusted sign-in characteristics, configure threat protection in audit-only mode and provide a mechanism for users or administrators to submit feedback. Your feedback can tell Amazon Cognito that a risk rating was assigned at a level you don't agree with. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminSetUserSettingsResponse : sig ... end

Represents the response from the server to set user settings as an administrator.

Sourcemodule AdminSetUserSettingsRequest : sig ... end

You can use this parameter to set an MFA configuration that uses the SMS delivery medium.

Sourcemodule AdminSetUserPasswordResponse : sig ... end

Sets the specified user's password in a user pool. This operation administratively sets a temporary or permanent password for a user. With this operation, you can bypass self-service password changes and permit immediate sign-in with the password that you set. To do this, set Permanent to true. You can also set a new temporary password in this request, send it to a user, and require them to choose a new password on their next sign-in. To do this, set Permanent to false. If the password is temporary, the user's Status becomes FORCE_CHANGE_PASSWORD. When the user next tries to sign in, the InitiateAuth or AdminInitiateAuth response includes the NEW_PASSWORD_REQUIRED challenge. If the user doesn't sign in before the temporary password expires, they can no longer sign in and you must repeat this operation to set a temporary or permanent password for them. After the user sets a new password, or if you set a permanent password, their status becomes Confirmed. AdminSetUserPassword can set a password for the user profile that Amazon Cognito creates for third-party federated users. When you set a password, the federated user's status changes from EXTERNAL_PROVIDER to CONFIRMED. A user in this state can sign in as a federated user, and initiate authentication flows in the API like a linked native user. They can also modify their password and attributes in token-authenticated API requests like ChangePassword and UpdateUserAttributes. As a best security practice and to keep users in sync with your external IdP, don't set passwords on federated user profiles. To set up a federated user for native sign-in with a linked native user, refer to Linking federated users to an existing user profile. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminSetUserPasswordRequest : sig ... end

Sets the specified user's password in a user pool. This operation administratively sets a temporary or permanent password for a user. With this operation, you can bypass self-service password changes and permit immediate sign-in with the password that you set. To do this, set Permanent to true. You can also set a new temporary password in this request, send it to a user, and require them to choose a new password on their next sign-in. To do this, set Permanent to false. If the password is temporary, the user's Status becomes FORCE_CHANGE_PASSWORD. When the user next tries to sign in, the InitiateAuth or AdminInitiateAuth response includes the NEW_PASSWORD_REQUIRED challenge. If the user doesn't sign in before the temporary password expires, they can no longer sign in and you must repeat this operation to set a temporary or permanent password for them. After the user sets a new password, or if you set a permanent password, their status becomes Confirmed. AdminSetUserPassword can set a password for the user profile that Amazon Cognito creates for third-party federated users. When you set a password, the federated user's status changes from EXTERNAL_PROVIDER to CONFIRMED. A user in this state can sign in as a federated user, and initiate authentication flows in the API like a linked native user. They can also modify their password and attributes in token-authenticated API requests like ChangePassword and UpdateUserAttributes. As a best security practice and to keep users in sync with your external IdP, don't set passwords on federated user profiles. To set up a federated user for native sign-in with a linked native user, refer to Linking federated users to an existing user profile. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminSetUserMFAPreferenceResponse : sig ... end

Sets the user's multi-factor authentication (MFA) preference, including which MFA options are activated, and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminSetUserMFAPreferenceRequest : sig ... end

Sets the user's multi-factor authentication (MFA) preference, including which MFA options are activated, and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminRespondToAuthChallengeResponse : sig ... end

Responds to the authentication challenge, as an administrator.

Sourcemodule AdminRespondToAuthChallengeRequest : sig ... end

The request to respond to the authentication challenge, as an administrator.

Sourcemodule AdminResetUserPasswordResponse : sig ... end

Represents the response from the server to reset a user password as an administrator.

Sourcemodule AdminResetUserPasswordRequest : sig ... end

Represents the request to reset a user's password as an administrator.

Sourcemodule AdminRemoveUserFromGroupRequest : sig ... end

Given a username and a group name, removes them from the group. User pool groups are identifiers that you can reference from the contents of ID and access tokens, and set preferred IAM roles for identity-pool authentication. For more information, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminListUserAuthEventsResponse : sig ... end

Requests a history of user activity and any risks detected as part of Amazon Cognito threat protection. For more information, see Viewing user event history. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminListUserAuthEventsRequest : sig ... end

Requests a history of user activity and any risks detected as part of Amazon Cognito threat protection. For more information, see Viewing user event history. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminListGroupsForUserResponse : sig ... end

Lists the groups that a user belongs to. User pool groups are identifiers that you can reference from the contents of ID and access tokens, and set preferred IAM roles for identity-pool authentication. For more information, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminListGroupsForUserRequest : sig ... end

Lists the groups that a user belongs to. User pool groups are identifiers that you can reference from the contents of ID and access tokens, and set preferred IAM roles for identity-pool authentication. For more information, see Adding groups to a user pool. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminListDevicesResponse : sig ... end

Lists the device's response, as an administrator.

Sourcemodule AdminListDevicesRequest : sig ... end

Represents the request to list devices, as an administrator.

Sourcemodule AdminLinkProviderForUserResponse : sig ... end

Links an existing user account in a user pool, or DestinationUser, to an identity from an external IdP, or SourceUser, based on a specified attribute name and value from the external IdP. This operation connects a local user profile with a user identity who hasn't yet signed in from their third-party IdP. When the user signs in with their IdP, they get access-control configuration from the local user profile. Linked local users can also sign in with SDK-based API operations like InitiateAuth after they sign in at least once through their IdP. For more information, see Linking federated users. The maximum number of federated identities linked to a user is five. Because this API allows a user with an external federated identity to sign in as a local user, it is critical that it only be used with external IdPs and linked attributes that you trust. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminLinkProviderForUserRequest : sig ... end

Links an existing user account in a user pool, or DestinationUser, to an identity from an external IdP, or SourceUser, based on a specified attribute name and value from the external IdP. This operation connects a local user profile with a user identity who hasn't yet signed in from their third-party IdP. When the user signs in with their IdP, they get access-control configuration from the local user profile. Linked local users can also sign in with SDK-based API operations like InitiateAuth after they sign in at least once through their IdP. For more information, see Linking federated users. The maximum number of federated identities linked to a user is five. Because this API allows a user with an external federated identity to sign in as a local user, it is critical that it only be used with external IdPs and linked attributes that you trust. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminInitiateAuthResponse : sig ... end

Initiates the authentication response, as an administrator.

Sourcemodule AdminInitiateAuthRequest : sig ... end

Initiates the authorization request, as an administrator.

Sourcemodule AdminGetUserResponse : sig ... end

Represents the response from the server from the request to get the specified user as an administrator.

Sourcemodule AdminGetUserRequest : sig ... end

Represents the request to get the specified user as an administrator.

Sourcemodule AdminGetDeviceResponse : sig ... end

Gets the device response, as an administrator.

Sourcemodule AdminGetDeviceRequest : sig ... end

Represents the request to get the device, as an administrator.

Sourcemodule AdminForgetDeviceRequest : sig ... end

Sends the forgot device request, as an administrator.

Sourcemodule AdminEnableUserResponse : sig ... end

Represents the response from the server for the request to enable a user as an administrator.

Sourcemodule AdminEnableUserRequest : sig ... end

Represents the request that enables the user as an administrator.

Sourcemodule AdminDisableUserResponse : sig ... end

Represents the response received from the server to disable the user as an administrator.

Sourcemodule AdminDisableUserRequest : sig ... end

Represents the request to disable the user as an administrator.

Sourcemodule AdminDisableProviderForUserResponse : sig ... end

Prevents the user from signing in with the specified external (SAML or social) identity provider (IdP). If the user that you want to deactivate is a Amazon Cognito user pools native username + password user, they can't use their password to sign in. If the user to deactivate is a linked external IdP user, any link between that user and an existing user is removed. When the external user signs in again, and the user is no longer attached to the previously linked DestinationUser, the user must create a new user account. The value of ProviderName must match the name of a user pool IdP. To deactivate a local user, set ProviderName to Cognito and the ProviderAttributeName to Cognito_Subject. The ProviderAttributeValue must be user's local username. The ProviderAttributeName must always be Cognito_Subject for social IdPs. The ProviderAttributeValue must always be the exact subject that was used when the user was originally linked as a source user. For de-linking a SAML identity, there are two scenarios. If the linked identity has not yet been used to sign in, the ProviderAttributeName and ProviderAttributeValue must be the same values that were used for the SourceUser when the identities were originally linked using AdminLinkProviderForUser call. This is also true if the linking was done with ProviderAttributeName set to Cognito_Subject. If the user has already signed in, the ProviderAttributeName must be Cognito_Subject and ProviderAttributeValue must be the NameID from their SAML assertion. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminDisableProviderForUserRequest : sig ... end

Prevents the user from signing in with the specified external (SAML or social) identity provider (IdP). If the user that you want to deactivate is a Amazon Cognito user pools native username + password user, they can't use their password to sign in. If the user to deactivate is a linked external IdP user, any link between that user and an existing user is removed. When the external user signs in again, and the user is no longer attached to the previously linked DestinationUser, the user must create a new user account. The value of ProviderName must match the name of a user pool IdP. To deactivate a local user, set ProviderName to Cognito and the ProviderAttributeName to Cognito_Subject. The ProviderAttributeValue must be user's local username. The ProviderAttributeName must always be Cognito_Subject for social IdPs. The ProviderAttributeValue must always be the exact subject that was used when the user was originally linked as a source user. For de-linking a SAML identity, there are two scenarios. If the linked identity has not yet been used to sign in, the ProviderAttributeName and ProviderAttributeValue must be the same values that were used for the SourceUser when the identities were originally linked using AdminLinkProviderForUser call. This is also true if the linking was done with ProviderAttributeName set to Cognito_Subject. If the user has already signed in, the ProviderAttributeName must be Cognito_Subject and ProviderAttributeValue must be the NameID from their SAML assertion. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AdminDeleteUserRequest : sig ... end

Represents the request to delete a user as an administrator.

Sourcemodule AdminDeleteUserAttributesResponse : sig ... end

Represents the response received from the server for a request to delete user attributes.

Sourcemodule AdminDeleteUserAttributesRequest : sig ... end

Represents the request to delete user attributes as an administrator.

Sourcemodule AdminCreateUserResponse : sig ... end

Represents the response from the server to the request to create the user.

Sourcemodule AdminCreateUserRequest : sig ... end

Creates a new user in the specified user pool.

Sourcemodule AdminConfirmSignUpResponse : sig ... end

Represents the response from the server for the request to confirm registration.

Sourcemodule AdminConfirmSignUpRequest : sig ... end

Confirm a user's registration as a user pool administrator.

Sourcemodule AdminAddUserToGroupRequest : sig ... end

Adds a user to a group. A user who is in a group can present a preferred-role claim to an identity pool, and populates a cognito:groups claim to their access and identity tokens. Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy. Learn more Signing Amazon Web Services API Requests Using the Amazon Cognito user pools API and user pool endpoints

Sourcemodule AddUserPoolClientSecretResponse : sig ... end

The response from creating a new client secret.

Sourcemodule AddUserPoolClientSecretRequest : sig ... end

The request to create a new client secret for a user pool app client.

Sourcemodule AddCustomAttributesResponse : sig ... end

Represents the response from the server for the request to add custom attributes.

Sourcemodule AddCustomAttributesRequest : sig ... end

Represents the request to add custom attributes.