UpdateUserAttributes
With this operation, your users can update one or more of their attributes with their
own credentials. You authorize this API request with the user's access token. To delete
an attribute from your user, submit the attribute in your API request with a blank
value. Custom attribute values in this request must include the custom:
prefix.
Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin
.
Note
Amazon Cognito doesn't evaluate AWS Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you can't use IAM credentials to authorize requests, and you can't grant IAM permissions in policies. For more information about authorization models in Amazon Cognito, see Using the Amazon Cognito user pools API and user pool endpoints.
Note
This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers
require you to register an origination phone number before you can send SMS messages
to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a
phone number with Amazon Pinpoint
If you have never used SMS text messages with Amazon Cognito or any other AWS service, Amazon Simple Notification Service might place your account in the SMS sandbox. In sandbox mode , you can send messages only to verified phone numbers. After you test your app while in the sandbox environment, you can move out of the sandbox and into production. For more information, see SMS message settings for Amazon Cognito user pools in the Amazon Cognito Developer Guide.
Request Syntax
{
"AccessToken": "string
",
"ClientMetadata": {
"string
" : "string
"
},
"UserAttributes": [
{
"Name": "string
",
"Value": "string
"
}
]
}
Request Parameters
For information about the parameters that are common to all actions, see Common Parameters.
The request accepts the following data in JSON format.
- AccessToken
-
A valid access token that Amazon Cognito issued to the user whose user attributes you want to update.
Type: String
Pattern:
[A-Za-z0-9-_=.]+
Required: Yes
- ClientMetadata
-
A map of custom key-value pairs that you can provide as input for any custom workflows that this action initiates.
You create custom workflows by assigning Lambda functions to user pool triggers. When you use the UpdateUserAttributes API action, Amazon Cognito invokes the function that is assigned to the custom message trigger. When Amazon Cognito invokes this function, it passes a JSON payload, which the function receives as input. This payload contains a
clientMetadata
attribute, which provides the data that you assigned to the ClientMetadata parameter in your UpdateUserAttributes request. In your function code in Lambda, you can process theclientMetadata
value to enhance your workflow for your specific needs.For more information, see Customizing user pool Workflows with Lambda Triggers in the Amazon Cognito Developer Guide.
Note
When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the following:
-
Store the ClientMetadata value. This data is available only to AWS Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration doesn't include triggers, the ClientMetadata parameter serves no purpose.
-
Validate the ClientMetadata value.
-
Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive information.
Type: String to string map
Key Length Constraints: Minimum length of 0. Maximum length of 131072.
Value Length Constraints: Minimum length of 0. Maximum length of 131072.
Required: No
-
- UserAttributes
-
An array of name-value pairs representing user attributes.
For custom attributes, you must prepend the
custom:
prefix to the attribute name.If you have set an attribute to require verification before Amazon Cognito updates its value, this request doesn’t immediately update the value of that attribute. After your user receives and responds to a verification message to verify the new value, Amazon Cognito updates the attribute value. Your user can sign in and receive messages with the original attribute value until they verify the new value.
Type: Array of AttributeType objects
Required: Yes
Response Syntax
{
"CodeDeliveryDetailsList": [
{
"AttributeName": "string",
"DeliveryMedium": "string",
"Destination": "string"
}
]
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- CodeDeliveryDetailsList
-
The code delivery details list from the server for the request to update user attributes.
Type: Array of CodeDeliveryDetailsType objects
Errors
For information about the errors that are common to all actions, see Common Errors.
- AliasExistsException
-
This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.
HTTP Status Code: 400
- CodeDeliveryFailureException
-
This exception is thrown when a verification code fails to deliver successfully.
HTTP Status Code: 400
- CodeMismatchException
-
This exception is thrown if the provided code doesn't match what the server was expecting.
HTTP Status Code: 400
- ExpiredCodeException
-
This exception is thrown if a code has expired.
HTTP Status Code: 400
- ForbiddenException
-
This exception is thrown when AWS WAF doesn't allow your request based on a web ACL that's associated with your user pool.
HTTP Status Code: 400
- InternalErrorException
-
This exception is thrown when Amazon Cognito encounters an internal error.
HTTP Status Code: 500
- InvalidEmailRoleAccessPolicyException
-
This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.
HTTP Status Code: 400
- InvalidLambdaResponseException
-
This exception is thrown when Amazon Cognito encounters an invalid AWS Lambda response.
HTTP Status Code: 400
- InvalidParameterException
-
This exception is thrown when the Amazon Cognito service encounters an invalid parameter.
HTTP Status Code: 400
- InvalidSmsRoleAccessPolicyException
-
This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.
HTTP Status Code: 400
- InvalidSmsRoleTrustRelationshipException
-
This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust
cognito-idp.amazonaws.com
or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.HTTP Status Code: 400
- NotAuthorizedException
-
This exception is thrown when a user isn't authorized.
HTTP Status Code: 400
- PasswordResetRequiredException
-
This exception is thrown when a password reset is required.
HTTP Status Code: 400
- ResourceNotFoundException
-
This exception is thrown when the Amazon Cognito service can't find the requested resource.
HTTP Status Code: 400
- TooManyRequestsException
-
This exception is thrown when the user has made too many requests for a given operation.
HTTP Status Code: 400
- UnexpectedLambdaException
-
This exception is thrown when Amazon Cognito encounters an unexpected exception with AWS Lambda.
HTTP Status Code: 400
- UserLambdaValidationException
-
This exception is thrown when the Amazon Cognito service encounters a user validation exception with the AWS Lambda service.
HTTP Status Code: 400
- UserNotConfirmedException
-
This exception is thrown when a user isn't confirmed successfully.
HTTP Status Code: 400
- UserNotFoundException
-
This exception is thrown when a user isn't found.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following: