Request Syntax Request Parameters Response Syntax Response Elements Errors See Also

CreateUserPool

Creates a new Amazon Cognito user pool and sets the password policy for the pool.

Request Syntax


{
   "AccountRecoverySetting": { 
      "RecoveryMechanisms": [ 
         { 
            "Name": "string",
            "Priority": number
         }
      ]
   },
   "AdminCreateUserConfig": { 
      "AllowAdminCreateUserOnly": boolean,
      "InviteMessageTemplate": { 
         "EmailMessage": "string",
         "EmailSubject": "string",
         "SMSMessage": "string"
      },
      "UnusedAccountValidityDays": number
   },
   "AliasAttributes": [ "string" ],
   "AutoVerifiedAttributes": [ "string" ],
   "DeviceConfiguration": { 
      "ChallengeRequiredOnNewDevice": boolean,
      "DeviceOnlyRememberedOnUserPrompt": boolean
   },
   "EmailConfiguration": { 
      "ConfigurationSet": "string",
      "EmailSendingAccount": "string",
      "From": "string",
      "ReplyToEmailAddress": "string",
      "SourceArn": "string"
   },
   "EmailVerificationMessage": "string",
   "EmailVerificationSubject": "string",
   "LambdaConfig": { 
      "CreateAuthChallenge": "string",
      "CustomMessage": "string",
      "DefineAuthChallenge": "string",
      "PostAuthentication": "string",
      "PostConfirmation": "string",
      "PreAuthentication": "string",
      "PreSignUp": "string",
      "PreTokenGeneration": "string",
      "UserMigration": "string",
      "VerifyAuthChallengeResponse": "string"
   },
   "MfaConfiguration": "string",
   "Policies": { 
      "PasswordPolicy": { 
         "MinimumLength": number,
         "RequireLowercase": boolean,
         "RequireNumbers": boolean,
         "RequireSymbols": boolean,
         "RequireUppercase": boolean,
         "TemporaryPasswordValidityDays": number
      }
   },
   "PoolName": "string",
   "Schema": [ 
      { 
         "AttributeDataType": "string",
         "DeveloperOnlyAttribute": boolean,
         "Mutable": boolean,
         "Name": "string",
         "NumberAttributeConstraints": { 
            "MaxValue": "string",
            "MinValue": "string"
         },
         "Required": boolean,
         "StringAttributeConstraints": { 
            "MaxLength": "string",
            "MinLength": "string"
         }
      }
   ],
   "SmsAuthenticationMessage": "string",
   "SmsConfiguration": { 
      "ExternalId": "string",
      "SnsCallerArn": "string"
   },
   "SmsVerificationMessage": "string",
   "UsernameAttributes": [ "string" ],
   "UsernameConfiguration": { 
      "CaseSensitive": boolean
   },
   "UserPoolAddOns": { 
      "AdvancedSecurityMode": "string"
   },
   "UserPoolTags": { 
      "string" : "string" 
   },
   "VerificationMessageTemplate": { 
      "DefaultEmailOption": "string",
      "EmailMessage": "string",
      "EmailMessageByLink": "string",
      "EmailSubject": "string",
      "EmailSubjectByLink": "string",
      "SmsMessage": "string"
   }
}

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.

AccountRecoverySetting

Use this setting to define which verified available method a user can use to recover their password when they call ForgotPassword. It allows you to define a preferred method when a user has more than one method available. With this setting, SMS does not qualify for a valid password recovery mechanism if the user also has SMS MFA enabled. In the absence of this setting, Cognito uses the legacy behavior to determine the recovery method where SMS is preferred over email.

Type: AccountRecoverySettingType object

Required: No

AdminCreateUserConfig

The configuration for AdminCreateUser requests.

Type: AdminCreateUserConfigType object

Required: No

AliasAttributes

Attributes supported as an alias for this user pool. Possible values: phone_number, email, or preferred_username.

Type: Array of strings

Valid Values: phone_number | email | preferred_username

Required: No

AutoVerifiedAttributes

The attributes to be auto-verified. Possible values: email, phone_number.

Type: Array of strings

Valid Values: phone_number | email

Required: No

DeviceConfiguration

The device configuration.

Type: DeviceConfigurationType object

Required: No

EmailConfiguration

The email configuration.

Type: EmailConfigurationType object

Required: No

EmailVerificationMessage

A string representing the email verification message. EmailVerificationMessage is allowed only if EmailSendingAccount is DEVELOPER.

Type: String

Length Constraints: Minimum length of 6. Maximum length of 20000.

Pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*

Required: No

EmailVerificationSubject

A string representing the email verification subject. EmailVerificationSubject is allowed only if EmailSendingAccount is DEVELOPER.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 140.

Pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}\s]+

Required: No

LambdaConfig

The Lambda trigger configuration information for the new user pool.

Note

In a push model, event sources (such as Amazon S3 and custom applications) need permission to invoke a function. So you will need to make an extra call to add permission for these event sources to invoke your Lambda function.

For more information on using the Lambda API to add permission, see AddPermission .

For adding permission using the AWS CLI, see add-permission .

Type: LambdaConfigType object

Required: No

MfaConfiguration

Specifies MFA configuration details.

Type: String

Valid Values: OFF | ON | OPTIONAL

Required: No

Policies

The policies associated with the new user pool.

Type: UserPoolPolicyType object

Required: No

PoolName

A string used to name the user pool.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: [\w\s+=,.@-]+

Required: Yes

Schema

An array of schema attributes for the new user pool. These attributes can be standard or custom attributes.

Type: Array of SchemaAttributeType objects

Array Members: Minimum number of 1 item. Maximum number of 50 items.

Required: No

SmsAuthenticationMessage

A string representing the SMS authentication message.

Type: String

Length Constraints: Minimum length of 6. Maximum length of 140.

Pattern: .*\{####\}.*

Required: No

SmsConfiguration

The SMS configuration.

Type: SmsConfigurationType object

Required: No

SmsVerificationMessage

A string representing the SMS verification message.

Type: String

Length Constraints: Minimum length of 6. Maximum length of 140.

Pattern: .*\{####\}.*

Required: No

UsernameAttributes

Specifies whether email addresses or phone numbers can be specified as usernames when a user signs up.

Type: Array of strings

Valid Values: phone_number | email

Required: No

UsernameConfiguration

You can choose to set case sensitivity on the username input for the selected sign-in option. For example, when this is set to False, users will be able to sign in using either "username" or "Username". This configuration is immutable once it has been set. For more information, see UsernameConfigurationType.

Type: UsernameConfigurationType object

Required: No

UserPoolAddOns

Used to enable advanced security risk detection. Set the key AdvancedSecurityMode to the value "AUDIT".

Type: UserPoolAddOnsType object

Required: No

UserPoolTags

The tag keys and values to assign to the user pool. A tag is a label that you can use to categorize and manage user pools in different ways, such as by purpose, owner, environment, or other criteria.

Type: String to string map

Key Length Constraints: Minimum length of 1. Maximum length of 128.

Value Length Constraints: Minimum length of 0. Maximum length of 256.

Required: No

VerificationMessageTemplate

The template for the verification message that the user sees when the app requests permission to access the user's information.

Type: VerificationMessageTemplateType object

Required: No

Response Syntax


{
   "UserPool": { 
      "AccountRecoverySetting": { 
         "RecoveryMechanisms": [ 
            { 
               "Name": "string",
               "Priority": number
            }
         ]
      },
      "AdminCreateUserConfig": { 
         "AllowAdminCreateUserOnly": boolean,
         "InviteMessageTemplate": { 
            "EmailMessage": "string",
            "EmailSubject": "string",
            "SMSMessage": "string"
         },
         "UnusedAccountValidityDays": number
      },
      "AliasAttributes": [ "string" ],
      "Arn": "string",
      "AutoVerifiedAttributes": [ "string" ],
      "CreationDate": number,
      "CustomDomain": "string",
      "DeviceConfiguration": { 
         "ChallengeRequiredOnNewDevice": boolean,
         "DeviceOnlyRememberedOnUserPrompt": boolean
      },
      "Domain": "string",
      "EmailConfiguration": { 
         "ConfigurationSet": "string",
         "EmailSendingAccount": "string",
         "From": "string",
         "ReplyToEmailAddress": "string",
         "SourceArn": "string"
      },
      "EmailConfigurationFailure": "string",
      "EmailVerificationMessage": "string",
      "EmailVerificationSubject": "string",
      "EstimatedNumberOfUsers": number,
      "Id": "string",
      "LambdaConfig": { 
         "CreateAuthChallenge": "string",
         "CustomMessage": "string",
         "DefineAuthChallenge": "string",
         "PostAuthentication": "string",
         "PostConfirmation": "string",
         "PreAuthentication": "string",
         "PreSignUp": "string",
         "PreTokenGeneration": "string",
         "UserMigration": "string",
         "VerifyAuthChallengeResponse": "string"
      },
      "LastModifiedDate": number,
      "MfaConfiguration": "string",
      "Name": "string",
      "Policies": { 
         "PasswordPolicy": { 
            "MinimumLength": number,
            "RequireLowercase": boolean,
            "RequireNumbers": boolean,
            "RequireSymbols": boolean,
            "RequireUppercase": boolean,
            "TemporaryPasswordValidityDays": number
         }
      },
      "SchemaAttributes": [ 
         { 
            "AttributeDataType": "string",
            "DeveloperOnlyAttribute": boolean,
            "Mutable": boolean,
            "Name": "string",
            "NumberAttributeConstraints": { 
               "MaxValue": "string",
               "MinValue": "string"
            },
            "Required": boolean,
            "StringAttributeConstraints": { 
               "MaxLength": "string",
               "MinLength": "string"
            }
         }
      ],
      "SmsAuthenticationMessage": "string",
      "SmsConfiguration": { 
         "ExternalId": "string",
         "SnsCallerArn": "string"
      },
      "SmsConfigurationFailure": "string",
      "SmsVerificationMessage": "string",
      "Status": "string",
      "UsernameAttributes": [ "string" ],
      "UsernameConfiguration": { 
         "CaseSensitive": boolean
      },
      "UserPoolAddOns": { 
         "AdvancedSecurityMode": "string"
      },
      "UserPoolTags": { 
         "string" : "string" 
      },
      "VerificationMessageTemplate": { 
         "DefaultEmailOption": "string",
         "EmailMessage": "string",
         "EmailMessageByLink": "string",
         "EmailSubject": "string",
         "EmailSubjectByLink": "string",
         "SmsMessage": "string"
      }
   }
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

UserPool

A container for the user pool details.

Type: UserPoolType object

Errors

For information about the errors that are common to all actions, see Common Errors.

InternalErrorException

This exception is thrown when Amazon Cognito encounters an internal error.

HTTP Status Code: 500

InvalidEmailRoleAccessPolicyException

This exception is thrown when Amazon Cognito is not allowed to use your email identity. HTTP status code: 400.

HTTP Status Code: 400

InvalidParameterException

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

HTTP Status Code: 400

InvalidSmsRoleAccessPolicyException

This exception is returned when the role provided for SMS configuration does not have permission to publish using Amazon SNS.

HTTP Status Code: 400

InvalidSmsRoleTrustRelationshipException

This exception is thrown when the trust relationship is invalid for the role provided for SMS configuration. This can happen if you do not trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

HTTP Status Code: 400

LimitExceededException

This exception is thrown when a user exceeds the limit for a requested AWS resource.

HTTP Status Code: 400

NotAuthorizedException

This exception is thrown when a user is not authorized.

HTTP Status Code: 400

TooManyRequestsException

This exception is thrown when the user has made too many requests for a given operation.

HTTP Status Code: 400

UserPoolTaggingException

This exception is thrown when a user pool tag cannot be set or updated.

HTTP Status Code: 400