# Amazon Cognito User Pools API Reference

> With the Amazon Cognito user pools API, you can configure user pools and authenticate users. To authenticate users from third-party identity providers (IdPs) in this API, you can link IdP users to native user profiles. Learn more about the authentication and authorization of federated users at Adding user pool sign-in through a third party and in the User pool federation endpoints and managed login reference.

- [Welcome](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/Welcome.md)
- [Common Parameters](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/CommonParameters.md)
- [Common Error Types](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/CommonErrors.md)

## [Actions](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.md)

- [AddCustomAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddCustomAttributes.md): Adds additional user attributes to the user pool schema.
- [AddUserPoolClientSecret](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddUserPoolClientSecret.md): Creates a new client secret for an existing confidential user pool app client.
- [AdminAddUserToGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminAddUserToGroup.md): Adds a user to a group.
- [AdminConfirmSignUp](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminConfirmSignUp.md): Confirms user sign-up as an administrator.
- [AdminCreateUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.md): Creates a new user in the specified user pool.
- [AdminDeleteSoftwareToken](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteSoftwareToken.md): Deletes a user's registered time-based one-time password (TOTP) multi-factor authentication (MFA) factor, also known as a software token.
- [AdminDeleteUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUser.md): Deletes a user profile in your user pool.
- [AdminDeleteUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUserAttributes.md): Deletes attribute values from a user.
- [AdminDisableProviderForUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableProviderForUser.md): Prevents the user from signing in with the specified external (SAML or social) identity provider (IdP).
- [AdminDisableUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableUser.md): Deactivates a user profile and revokes all access tokens for the user.
- [AdminEnableUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminEnableUser.md): Activates sign-in for a user profile that previously had sign-in access disabled.
- [AdminForgetDevice](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminForgetDevice.md): Forgets, or deletes, a remembered device from a user's profile.
- [AdminGetDevice](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetDevice.md): Given the device key, returns details for a user's device.
- [AdminGetUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.md): Given a username, returns details about a user profile in a user pool.
- [AdminGetUserAuthFactors](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUserAuthFactors.md): Lists the authentication options for a user in a user pool.
- [AdminInitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.md): Starts sign-in for applications with a server-side component, for example a traditional web application.
- [AdminLinkProviderForUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.md): Links an existing user account in a user pool, or DestinationUser, to an identity from an external IdP, or SourceUser, based on a specified attribute name and value from the external IdP.
- [AdminListDevices](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListDevices.md): Lists a user's registered devices.
- [AdminListGroupsForUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListGroupsForUser.md): Lists the groups that a user belongs to.
- [AdminListUserAuthEvents](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListUserAuthEvents.md): Requests a history of user activity and any risks detected as part of Amazon Cognito threat protection.
- [AdminRemoveUserFromGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRemoveUserFromGroup.md): Given a username and a group name, removes them from the group.
- [AdminResetUserPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.md): Begins the password reset process.
- [AdminRespondToAuthChallenge](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRespondToAuthChallenge.md): Some API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge.
- [AdminSetUserMFAPreference](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserMFAPreference.md): Sets the user's multi-factor authentication (MFA) preference, including which MFA options are activated, and if any are preferred.
- [AdminSetUserPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.md): Sets the specified user's password in a user pool.
- [AdminSetUserSettings](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserSettings.md): This action is no longer supported.
- [AdminUpdateAuthEventFeedback](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateAuthEventFeedback.md): Provides the feedback for an authentication event generated by threat protection features.
- [AdminUpdateDeviceStatus](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateDeviceStatus.md): Updates the status of a user's device so that it is marked as remembered or not remembered for the purpose of device authentication.
- [AdminUpdateUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.md): Updates the specified user's attributes.
- [AdminUserGlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.md): Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user.
- [AssociateSoftwareToken](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssociateSoftwareToken.md): Begins setup of time-based one-time password (TOTP) multi-factor authentication (MFA) for a user, with a unique private key that Amazon Cognito generates and returns in the API response.
- [ChangePassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ChangePassword.md): Changes the password for the currently signed-in user.
- [CompleteWebAuthnRegistration](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CompleteWebAuthnRegistration.md): Completes registration of a passkey authenticator for the currently signed-in user.
- [ConfirmDevice](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmDevice.md): Confirms a device that a user wants to remember.
- [ConfirmForgotPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmForgotPassword.md): This public API operation accepts a confirmation code that Amazon Cognito sent to a user and accepts a new password for that user.
- [ConfirmSignUp](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmSignUp.md): Confirms the account of a new user.
- [CreateGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateGroup.md): Creates a new group in the specified user pool.
- [CreateIdentityProvider](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.md): Adds a configuration and trust relationship between a third-party identity provider (IdP) and a user pool.
- [CreateManagedLoginBranding](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateManagedLoginBranding.md): Creates a new set of branding settings for a user pool style and associates it with an app client.
- [CreateResourceServer](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateResourceServer.md): Creates a new OAuth2.0 resource server and defines custom scopes within it.
- [CreateTerms](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateTerms.md): Creates terms documents for the requested app client.
- [CreateUserImportJob](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserImportJob.md): Creates a user import job.
- [CreateUserPool](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.md): Creates a new Amazon Cognito user pool.
- [CreateUserPoolClient](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.md): Creates an app client in a user pool.
- [CreateUserPoolDomain](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolDomain.md): A user pool domain hosts managed login, an authorization server and web server for authentication in your application.
- [CreateUserPoolReplica](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolReplica.md): Creates a replica of an existing user pool in a specified AWS Region.
- [DeleteGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteGroup.md): Deletes a group from the specified user pool.
- [DeleteIdentityProvider](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteIdentityProvider.md): Deletes a user pool identity provider (IdP).
- [DeleteManagedLoginBranding](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteManagedLoginBranding.md): Deletes a managed login branding style.
- [DeleteResourceServer](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteResourceServer.md): Deletes a resource server.
- [DeleteTerms](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteTerms.md): Deletes the terms documents with the requested ID from your app client.
- [DeleteUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUser.md): Deletes the profile of the currently signed-in user.
- [DeleteUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserAttributes.md): Deletes attributes from the currently signed-in user.
- [DeleteUserPool](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPool.md): Deletes a user pool.
- [DeleteUserPoolClient](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClient.md): Deletes a user pool app client.
- [DeleteUserPoolClientSecret](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClientSecret.md): Deletes a specific client secret from a user pool app client.
- [DeleteUserPoolDomain](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolDomain.md): Given a user pool ID and domain identifier, deletes a user pool domain.
- [DeleteUserPoolReplica](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolReplica.md): Deletes a secondary replica user pool.
- [DeleteWebAuthnCredential](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteWebAuthnCredential.md): Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
- [DescribeIdentityProvider](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeIdentityProvider.md): Given a user pool ID and identity provider (IdP) name, returns details about the IdP.
- [DescribeManagedLoginBranding](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeManagedLoginBranding.md): Given the ID of a managed login branding style, returns detailed information about the style.
- [DescribeManagedLoginBrandingByClient](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeManagedLoginBrandingByClient.md): Given the ID of a user pool app client, returns detailed information about the style assigned to the app client.
- [DescribeResourceServer](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeResourceServer.md): Describes a resource server.
- [DescribeRiskConfiguration](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeRiskConfiguration.md): Given an app client or user pool ID where threat protection is configured, describes the risk configuration.
- [DescribeTerms](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeTerms.md): Returns details for the requested terms documents ID.
- [DescribeTermsByClient](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeTermsByClient.md): Returns details for the terms documents that are associated with an app client, identified by the app client ID, user pool ID, and terms name.
- [DescribeUserImportJob](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserImportJob.md): Describes a user import job.
- [DescribeUserPool](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.md): Given a user pool ID, returns configuration information.
- [DescribeUserPoolClient](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolClient.md): Given an app client ID, returns configuration information.
- [DescribeUserPoolDomain](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolDomain.md): Given a user pool domain name, returns information about the domain configuration.
- [ForgetDevice](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgetDevice.md): Given a device key, deletes a remembered device as the currently signed-in user.
- [ForgotPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.md): Sends a password-reset confirmation code to the email address or phone number of the requested username.
- [GetClientToken](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetClientToken.md): Issues an access token for machine-to-machine (M2M) authorization.
- [GetCSVHeader](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetCSVHeader.md): Given a user pool ID, generates a comma-separated value (CSV) list populated with available user attributes in the user pool.
- [GetDevice](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetDevice.md): Given a device key, returns information about a remembered device for the current user.
- [GetGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetGroup.md): Given a user pool ID and a group name, returns information about the user group.
- [GetIdentityProviderByIdentifier](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetIdentityProviderByIdentifier.md): Given the identifier of an identity provider (IdP), for example examplecorp, returns information about the user pool configuration for that IdP.
- [GetLogDeliveryConfiguration](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetLogDeliveryConfiguration.md): Given a user pool ID, returns the logging configuration.
- [GetProvisionedLimit](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetProvisionedLimit.md): Returns the current provisioned limit for a specific API category.
- [GetSigningCertificate](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetSigningCertificate.md): Given a user pool ID, returns the signing certificate for SAML 2.0 federation.
- [GetTokensFromRefreshToken](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetTokensFromRefreshToken.md): Given a refresh token, issues new ID, access, and optionally refresh tokens for the user who owns the submitted token.
- [GetUICustomization](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUICustomization.md): Given a user pool ID or app client, returns information about classic hosted UI branding that you applied, if any.
- [GetUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.md): Gets user attributes and and MFA settings for the currently signed-in user.
- [GetUserAttributeVerificationCode](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAttributeVerificationCode.md): Given an attribute name, sends a user attribute verification code for the specified attribute name to the currently signed-in user.
- [GetUserAuthFactors](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAuthFactors.md): Lists the authentication options for the currently signed-in user.
- [GetUserPoolMfaConfig](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserPoolMfaConfig.md): Given a user pool ID, returns configuration for sign-in with WebAuthn authenticators and for multi-factor authentication (MFA).
- [GlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.md): Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user.
- [InitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.md): Declares an authentication flow and initiates sign-in for a user in the Amazon Cognito user directory.
- [ListDevices](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListDevices.md): Lists the devices that Amazon Cognito has registered to the currently signed-in user.
- [ListGroups](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListGroups.md): Given a user pool ID, returns user pool groups and their details.
- [ListIdentityProviders](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListIdentityProviders.md): Given a user pool ID, returns information about configured identity providers (IdPs).
- [ListResourceServers](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListResourceServers.md): Given a user pool ID, returns all resource servers and their details.
- [ListTagsForResource](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTagsForResource.md): Lists the tags that are assigned to an Amazon Cognito user pool.
- [ListTerms](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTerms.md): Returns details about all terms documents for the requested user pool.
- [ListUserImportJobs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserImportJobs.md): Given a user pool ID, returns user import jobs and their details.
- [ListUserPoolClients](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClients.md): Given a user pool ID, lists app clients.
- [ListUserPoolClientSecrets](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClientSecrets.md): Lists all client secrets associated with a user pool app client.
- [ListUserPoolReplicas](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolReplicas.md): Lists all replicas for a user pool, including both primary and secondary replicas.
- [ListUserPools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPools.md): Lists user pools and their details in the current AWS account.
- [ListUsers](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.md): Given a user pool ID, returns a list of users and their basic details in a user pool.
- [ListUsersInGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.md): Given a user pool ID and a group name, returns a list of users in the group.
- [ListWebAuthnCredentials](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListWebAuthnCredentials.md): Generates a list of the currently signed-in user's registered passkey, or WebAuthn, credentials.
- [ResendConfirmationCode](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResendConfirmationCode.md): Resends the code that confirms a new account for a user who has signed up in your user pool.
- [RespondToAuthChallenge](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RespondToAuthChallenge.md): Some API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge.
- [RevokeToken](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.md): Revokes all of the access tokens generated by, and at the same time as, the specified refresh token.
- [SetLogDeliveryConfiguration](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetLogDeliveryConfiguration.md): Sets up or modifies the logging configuration of a user pool.
- [SetRiskConfiguration](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetRiskConfiguration.md): Configures threat protection for a user pool or app client.
- [SetUICustomization](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUICustomization.md): Configures UI branding settings for domains with the hosted UI (classic) branding version.
- [SetUserMFAPreference](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserMFAPreference.md): Set the user's multi-factor authentication (MFA) method preference, including which MFA factors are activated and if any are preferred.
- [SetUserPoolMfaConfig](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserPoolMfaConfig.md): Sets user pool multi-factor authentication (MFA) and passkey configuration.
- [SetUserSettings](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserSettings.md): This action is no longer supported.
- [SignUp](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignUp.md): Registers a user with an app client and requests a user name, password, and user attributes in the user pool.
- [StartUserImportJob](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartUserImportJob.md): Instructs your user pool to start importing users from a CSV file that contains their usernames and attributes.
- [StartWebAuthnRegistration](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartWebAuthnRegistration.md): Requests credential creation options from your user pool for the currently signed-in user.
- [StopUserImportJob](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StopUserImportJob.md): Instructs your user pool to stop a running job that's importing users from a CSV file that contains their usernames and attributes.
- [TagResource](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TagResource.md): Assigns a set of tags to an Amazon Cognito user pool.
- [UntagResource](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UntagResource.md): Given tag IDs that you previously assigned to a user pool, removes them.
- [UpdateAuthEventFeedback](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateAuthEventFeedback.md): Provides the feedback for an authentication event generated by threat protection features.
- [UpdateDeviceStatus](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.md): Updates the status of a the currently signed-in user's device so that it is marked as remembered or not remembered for the purpose of device authentication.
- [UpdateGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateGroup.md): Given the name of a user pool group, updates any of the properties for precedence, IAM role, or description.
- [UpdateIdentityProvider](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateIdentityProvider.md): Modifies the configuration and trust relationship between a third-party identity provider (IdP) and a user pool.
- [UpdateManagedLoginBranding](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateManagedLoginBranding.md): Configures the branding settings for a user pool style.
- [UpdateProvisionedLimit](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateProvisionedLimit.md): Sets the provisioned limit for a specific API category.
- [UpdateResourceServer](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateResourceServer.md): Updates the name and scopes of a resource server.
- [UpdateTerms](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateTerms.md): Modifies existing terms documents for the requested app client.
- [UpdateUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.md): Updates the currently signed-in user's attributes.
- [UpdateUserPool](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPool.md): Updates the configuration of a user pool.
- [UpdateUserPoolClient](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolClient.md): Given a user pool app client ID, updates the configuration.
- [UpdateUserPoolDomain](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolDomain.md): A user pool domain hosts managed login, an authorization server and web server for authentication in your application.
- [UpdateUserPoolReplica](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolReplica.md): Updates replica-specific settings for a user pool replica.
- [VerifySoftwareToken](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifySoftwareToken.md): Registers the current user's time-based one-time password (TOTP) authenticator with a code generated in their authenticator app from a private key that's supplied by your user pool.
- [VerifyUserAttribute](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifyUserAttribute.md): Submits a verification code for a signed-in user who has added or changed a value of an auto-verified attribute.


## [Data Types](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Types.md)

- [AccountRecoverySettingType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AccountRecoverySettingType.md): The settings for user message delivery in forgot-password operations.
- [AccountTakeoverActionsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AccountTakeoverActionsType.md): A list of account-takeover actions for each level of risk that Amazon Cognito might assess with threat protection features.
- [AccountTakeoverActionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AccountTakeoverActionType.md): The automated response to a risk level for adaptive authentication in full-function, or ENFORCED, mode.
- [AccountTakeoverRiskConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AccountTakeoverRiskConfigurationType.md): The settings for automated responses and notification templates for adaptive authentication with threat protection features.
- [AcrLevelConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AcrLevelConfigType.md): The configuration for a single authentication context class reference (ACR) level in a user pool.
- [AdminCreateUserConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUserConfigType.md): The settings for administrator creation of users in a user pool.
- [AdvancedSecurityAdditionalFlowsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdvancedSecurityAdditionalFlowsType.md): Threat protection configuration options for additional authentication types in your user pool, including custom authentication.
- [AnalyticsConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AnalyticsConfigurationType.md): The settings for Amazon Pinpoint analytics configuration.
- [AnalyticsMetadataType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AnalyticsMetadataType.md): Information that your application adds to authentication requests.
- [AssetType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssetType.md): An image file from a managed login branding style in a user pool.
- [AttributeType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AttributeType.md): The name and value of a user attribute.
- [AuthenticationResultType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AuthenticationResultType.md): The object that your application receives after authentication.
- [AuthEventType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AuthEventType.md): One authentication event that Amazon Cognito logged in a user pool with threat protection active.
- [ChallengeResponseType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ChallengeResponseType.md): The responses to the challenge that you received in the previous request.
- [ClientAuthenticationResultType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ClientAuthenticationResultType.md): The access token and its metadata from a machine-to-machine (M2M) client credentials grant.
- [ClientSecretDescriptorType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ClientSecretDescriptorType.md): Contains information about a client secret, including its unique identifier, value, and creation timestamp.
- [CloudWatchLogsConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CloudWatchLogsConfigurationType.md): Configuration for the CloudWatch log group destination of user pool detailed activity logging, or of user activity log export with threat protection.
- [CodeDeliveryDetailsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CodeDeliveryDetailsType.md): The delivery details for an email or SMS message that Amazon Cognito sent for authentication or verification.
- [CompromisedCredentialsActionsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CompromisedCredentialsActionsType.md): Settings for user pool actions when Amazon Cognito detects compromised credentials with threat protection in full-function ENFORCED mode.
- [CompromisedCredentialsRiskConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CompromisedCredentialsRiskConfigurationType.md): Settings for compromised-credentials actions and authentication-event sources with threat protection in full-function ENFORCED mode.
- [ContextDataType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ContextDataType.md): Contextual user data used for evaluating the risk of an authentication event by user pool threat protection.
- [CustomDomainConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CustomDomainConfigType.md): The configuration for a custom domain, including the SSL certificate and TLS security policy.
- [CustomEmailLambdaVersionConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CustomEmailLambdaVersionConfigType.md): The properties of a custom email sender Lambda trigger.
- [CustomSMSLambdaVersionConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CustomSMSLambdaVersionConfigType.md): The properties of a custom SMS sender Lambda trigger.
- [DeviceConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeviceConfigurationType.md): The device-remembering configuration for a user pool.
- [DeviceSecretVerifierConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeviceSecretVerifierConfigType.md): A Secure Remote Password (SRP) value that your application generates when you register a user's device.
- [DeviceType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeviceType.md): Information about a user's device that they've registered for device SRP authentication in your application.
- [DomainDescriptionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DomainDescriptionType.md): A container for information about the user pool domain associated with the hosted UI and OAuth endpoints.
- [EmailConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EmailConfigurationType.md): The email configuration of your user pool.
- [EmailMfaConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EmailMfaConfigType.md): Sets or shows configuration for user pool email message MFA and sign-in with one-time passwords (OTPs).
- [EmailMfaSettingsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EmailMfaSettingsType.md): User preferences for multi-factor authentication with email messages.
- [EumsSmsConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EumsSmsConfigurationType.md): The configuration that Amazon Cognito uses to send SMS messages through AWS End User Messaging SMS.
- [EventContextDataType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EventContextDataType.md): The context data that your application submitted in an authentication request with threat protection, as displayed in an AdminListUserAuthEvents response.
- [EventFeedbackType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EventFeedbackType.md): The feedback that your application submitted to a threat protection event log, as displayed in an AdminListUserAuthEvents response.
- [EventRiskType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EventRiskType.md): The risk evaluation by adaptive authentication, as displayed in an AdminListUserAuthEvents response.
- [FailoverType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_FailoverType.md): Specifies failover configuration for multi-region user pool domains.
- [FirehoseConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_FirehoseConfigurationType.md): Configuration for the Amazon Data Firehose stream destination of user activity log export with threat protection.
- [GroupType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GroupType.md): A user pool group.
- [HttpHeader](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_HttpHeader.md): The HTTP header in the ContextData parameter.
- [IdentityProviderType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_IdentityProviderType.md): A user pool identity provider (IdP).
- [InboundFederationLambdaType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InboundFederationLambdaType.md): The properties of an inbound federation Lambda trigger.
- [IssuerConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_IssuerConfigurationType.md): Specifies the issuer configuration for a user pool.
- [KeyConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_KeyConfigurationType.md): Specifies the key configuration for a user pool.
- [LambdaConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_LambdaConfigType.md): A collection of user pool Lambda triggers.
- [LimitDefinitionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_LimitDefinitionType.md): The class and attributes that identify a specific limit at the account level.
- [LimitType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_LimitType.md): The limit definition and current limit values for a provisioned limit.
- [LogConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_LogConfigurationType.md): The configuration of user event logs to an external AWS service like Amazon Data Firehose, Amazon S3, or Amazon CloudWatch Logs.
- [LogDeliveryConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_LogDeliveryConfigurationType.md): The logging parameters of a user pool, as returned in the response to a GetLogDeliveryConfiguration request.
- [ManagedLoginBrandingType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ManagedLoginBrandingType.md): A managed login branding style that's assigned to a user pool app client.
- [MessageTemplateType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_MessageTemplateType.md): The message template structure.
- [MFAOptionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_MFAOptionType.md): This data type is no longer supported.
- [NewDeviceMetadataType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_NewDeviceMetadataType.md): Information that your user pool responds with in AuthenticationResultwhen you configure it to remember devices and a user signs in with an unrecognized device.
- [NotifyConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_NotifyConfigurationType.md): The configuration for Amazon SES email messages that threat protection sends to a user when your adaptive authentication automated response has a Notify action.
- [NotifyEmailType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_NotifyEmailType.md): The template for email messages that threat protection sends to a user when your threat protection automated response has a Notify action.
- [NumberAttributeConstraintsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_NumberAttributeConstraintsType.md): The minimum and maximum values of an attribute that is of the number type, for example custom:age.
- [PasswordPolicyType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_PasswordPolicyType.md): The password policy settings for a user pool, including complexity, history, and length requirements.
- [PreTokenGenerationVersionConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_PreTokenGenerationVersionConfigType.md): The properties of a pre token generation Lambda trigger.
- [ProviderDescription](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ProviderDescription.md): The details of a user pool identity provider (IdP), including name and type.
- [ProviderUserIdentifierType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ProviderUserIdentifierType.md): The characteristics of a source or destination user for linking a federated user profile to a local user profile.
- [RecoveryOptionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RecoveryOptionType.md): A recovery option for a user.
- [RefreshTokenRotationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RefreshTokenRotationType.md): The configuration of your app client for refresh token rotation.
- [ResourceServerScopeType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResourceServerScopeType.md): One custom scope associated with a user pool resource server.
- [ResourceServerType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResourceServerType.md): The details of a resource server configuration and associated custom scopes in a user pool.
- [RiskConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RiskConfigurationType.md): The settings of risk configuration for threat protection with threat protection in a user pool.
- [RiskExceptionConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RiskExceptionConfigurationType.md): Exceptions to the risk evaluation configuration, including always-allow and always-block IP address ranges.
- [RoutingType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RoutingType.md): Specifies routing configuration for user pool domains.
- [S3ConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_S3ConfigurationType.md): Configuration for the Amazon S3 bucket destination of user activity log export with threat protection.
- [SchemaAttributeType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SchemaAttributeType.md): A list of the user attributes and their properties in your user pool.
- [SignInPolicyType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignInPolicyType.md): The policy for allowed types of authentication in a user pool.
- [SmsConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SmsConfigurationType.md): User pool configuration for delivery of SMS messages with Amazon Simple Notification Service.
- [SmsMfaConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SmsMfaConfigType.md): The configuration of multi-factor authentication (MFA) with SMS messages in a user pool.
- [SMSMfaSettingsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SMSMfaSettingsType.md): A user's preference for using SMS message multi-factor authentication (MFA).
- [SoftwareTokenMfaConfigType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SoftwareTokenMfaConfigType.md): Settings for time-based one-time password (TOTP) multi-factor authentication (MFA) in a user pool.
- [SoftwareTokenMfaSettingsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SoftwareTokenMfaSettingsType.md): A user's preference for using time-based one-time password (TOTP) multi-factor authentication (MFA).
- [StringAttributeConstraintsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StringAttributeConstraintsType.md): The minimum and maximum length values of an attribute that is of the string type, for example custom:department.
- [TermsDescriptionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TermsDescriptionType.md): The details of a set of terms documents.
- [TermsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TermsType.md): The details of a set of terms documents.
- [TokenValidityUnitsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TokenValidityUnitsType.md): The time units that, with IdTokenValidity, AccessTokenValidity, and RefreshTokenValidity, set and display the duration of ID, access, and refresh tokens for an app client.
- [UICustomizationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UICustomizationType.md): A container for the UI customization information for the hosted UI in a user pool.
- [UserAttributeUpdateSettingsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserAttributeUpdateSettingsType.md): The settings for updates to user attributes.
- [UserContextDataType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserContextDataType.md): Contextual data, such as the user's device fingerprint, IP address, or location, used for evaluating the risk of an unexpected event by Amazon Cognito threat protection.
- [UserImportJobType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserImportJobType.md): A user import job in a user pool.
- [UsernameConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UsernameConfigurationType.md): The configuration of a user pool for username case sensitivity.
- [UserPoolAddOnsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolAddOnsType.md): Contains settings for activation of threat protection, including the operating mode and additional authentication types.
- [UserPoolClientDescription](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolClientDescription.md): A short description of a user pool app client.
- [UserPoolClientType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolClientType.md): The configuration of a user pool client.
- [UserPoolDescriptionType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolDescriptionType.md): A short description of a user pool.
- [UserPoolPolicyType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolPolicyType.md): A list of user pool policies.
- [UserPoolReplicaType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolReplicaType.md): Contains information about a replica user pool, including Region, status, role, and ARN.
- [UserPoolType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolType.md): The configuration of a user pool.
- [UserType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserType.md): A user profile in a Amazon Cognito user pool.
- [VerificationMessageTemplateType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerificationMessageTemplateType.md): The template for the verification message that your user pool delivers to users who set an email address or phone number attribute.
- [WebAuthnConfigurationType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_WebAuthnConfigurationType.md): Settings for authentication (MFA) with passkey, or webauthN, biometric and security-key devices in a user pool.
- [WebAuthnCredentialDescription](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_WebAuthnCredentialDescription.md): The details of a passkey, or webauthN, biometric or security-key authentication factor for a user.
- [WebAuthnMfaSettingsType](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_WebAuthnMfaSettingsType.md): A user's preference for using passkey, or WebAuthn, multi-factor authentication (MFA).


## Full content

The entire guide is also available as a single markdown file, useful for feeding the full guide to an LLM in one pass:

- [Complete guide (single file)](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/full.md)