AddCustomAttributes

$result = $client->addCustomAttributes([/* ... */]);
$promise = $client->addCustomAttributesAsync([/* ... */]);

Adds additional user attributes to the user pool schema.

Parameter Syntax

$result = $client->addCustomAttributes([
    'CustomAttributes' => [ // REQUIRED
        [
            'AttributeDataType' => 'String|Number|DateTime|Boolean',
            'DeveloperOnlyAttribute' => true || false,
            'Mutable' => true || false,
            'Name' => '<string>',
            'NumberAttributeConstraints' => [
                'MaxValue' => '<string>',
                'MinValue' => '<string>',
            ],
            'Required' => true || false,
            'StringAttributeConstraints' => [
                'MaxLength' => '<string>',
                'MinLength' => '<string>',
            ],
        ],
        // ...
    ],
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserImportInProgressException:

This exception is thrown when you're trying to modify a user pool while a user import job is in progress for that pool.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminAddUserToGroup

$result = $client->adminAddUserToGroup([/* ... */]);
$promise = $client->adminAddUserToGroupAsync([/* ... */]);

Adds a user to a group. A user who is in a group can present a preferred-role claim to an identity pool, and populates a cognito:groups claim to their access and identity tokens.

Parameter Syntax

$result = $client->adminAddUserToGroup([
    'GroupName' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminConfirmSignUp

$result = $client->adminConfirmSignUp([/* ... */]);
$promise = $client->adminConfirmSignUpAsync([/* ... */]);

This IAM-authenticated API operation confirms user sign-up as an administrator. Unlike ConfirmSignUp, your IAM credentials authorize user account confirmation. No confirmation code is required.

This request sets a user account active in a user pool that requires confirmation of new user accounts before they can sign in. You can configure your user pool to not send confirmation codes to new users and instead confirm them with this API operation on the back end.

Parameter Syntax

$result = $client->adminConfirmSignUp([
    'ClientMetadata' => ['<string>', ...],
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyFailedAttemptsException:

This exception is thrown when the user has made too many failed attempts for a given action, such as sign-in.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminCreateUser

$result = $client->adminCreateUser([/* ... */]);
$promise = $client->adminCreateUserAsync([/* ... */]);

Creates a new user in the specified user pool.

If MessageAction isn't set, the default is to send a welcome message via email or phone (SMS).

This message is based on a template that you configured in your call to create or update a user pool. This template includes your custom sign-up instructions and placeholders for user name and temporary password.

Alternatively, you can call AdminCreateUser with SUPPRESS for the MessageAction parameter, and Amazon Cognito won't send any email.

In either case, the user will be in the FORCE_CHANGE_PASSWORD state until they sign in and change their password.

Parameter Syntax

$result = $client->adminCreateUser([
    'ClientMetadata' => ['<string>', ...],
    'DesiredDeliveryMediums' => ['<string>', ...],
    'ForceAliasCreation' => true || false,
    'MessageAction' => 'RESEND|SUPPRESS',
    'TemporaryPassword' => '<string>',
    'UserAttributes' => [
        [
            'Name' => '<string>', // REQUIRED
            'Value' => '<string>',
        ],
        // ...
    ],
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
    'ValidationData' => [
        [
            'Name' => '<string>', // REQUIRED
            'Value' => '<string>',
        ],
        // ...
    ],
]);

Parameter Details

Result Syntax

[
    'User' => [
        'Attributes' => [
            [
                'Name' => '<string>',
                'Value' => '<string>',
            ],
            // ...
        ],
        'Enabled' => true || false,
        'MFAOptions' => [
            [
                'AttributeName' => '<string>',
                'DeliveryMedium' => 'SMS|EMAIL',
            ],
            // ...
        ],
        'UserCreateDate' => <DateTime>,
        'UserLastModifiedDate' => <DateTime>,
        'UserStatus' => 'UNCONFIRMED|CONFIRMED|ARCHIVED|COMPROMISED|UNKNOWN|RESET_REQUIRED|FORCE_CHANGE_PASSWORD|EXTERNAL_PROVIDER',
        'Username' => '<string>',
    ],
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

UserNotFoundException:

This exception is thrown when a user isn't found.

UsernameExistsException:

This exception is thrown when Amazon Cognito encounters a user name that already exists in the user pool.

InvalidPasswordException:

This exception is thrown when Amazon Cognito encounters an invalid password.

CodeDeliveryFailureException:

This exception is thrown when a verification code fails to deliver successfully.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

PreconditionNotMetException:

This exception is thrown when a precondition is not met.

InvalidSmsRoleAccessPolicyException:

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

InvalidSmsRoleTrustRelationshipException:

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UnsupportedUserStateException:

The request failed because the user is in an unsupported state.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

Examples

Example 1: An AdminCreateUser request for for a test user named John.

This request submits a value for all possible parameters for AdminCreateUser.

$result = $client->adminCreateUser([
    'DesiredDeliveryMediums' => [
        'SMS',
    ],
    'MessageAction' => 'SUPPRESS',
    'TemporaryPassword' => 'This-is-my-test-99!',
    'UserAttributes' => [
        [
            'Name' => 'name',
            'Value' => 'John',
        ],
        [
            'Name' => 'phone_number',
            'Value' => '+12065551212',
        ],
        [
            'Name' => 'email',
            'Value' => 'testuser@example.com',
        ],
    ],
    'UserPoolId' => 'us-east-1_EXAMPLE',
    'Username' => 'testuser',
]);

Result syntax:

[
    'User' => [
        'Attributes' => [
            [
                'Name' => 'sub',
                'Value' => 'd16b4aa8-8633-4abd-93b3-5062a8e1b5f8',
            ],
            [
                'Name' => 'name',
                'Value' => 'John',
            ],
            [
                'Name' => 'phone_number',
                'Value' => '+12065551212',
            ],
            [
                'Name' => 'email',
                'Value' => 'testuser@example.com',
            ],
        ],
        'Enabled' => 1,
        'UserCreateDate' => ,
        'UserLastModifiedDate' => ,
        'UserStatus' => 'FORCE_CHANGE_PASSWORD',
        'Username' => 'testuser',
    ],
]

AdminDeleteUser

$result = $client->adminDeleteUser([/* ... */]);
$promise = $client->adminDeleteUserAsync([/* ... */]);

Deletes a user as an administrator. Works on any user.

Parameter Syntax

$result = $client->adminDeleteUser([
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminDeleteUserAttributes

$result = $client->adminDeleteUserAttributes([/* ... */]);
$promise = $client->adminDeleteUserAttributesAsync([/* ... */]);

Deletes the user attributes in a user pool as an administrator. Works on any user.

Parameter Syntax

$result = $client->adminDeleteUserAttributes([
    'UserAttributeNames' => ['<string>', ...], // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminDisableProviderForUser

$result = $client->adminDisableProviderForUser([/* ... */]);
$promise = $client->adminDisableProviderForUserAsync([/* ... */]);

Prevents the user from signing in with the specified external (SAML or social) identity provider (IdP). If the user that you want to deactivate is a Amazon Cognito user pools native username + password user, they can't use their password to sign in. If the user to deactivate is a linked external IdP user, any link between that user and an existing user is removed. When the external user signs in again, and the user is no longer attached to the previously linked DestinationUser, the user must create a new user account. See AdminLinkProviderForUser.

The ProviderName must match the value specified when creating an IdP for the pool.

To deactivate a native username + password user, the ProviderName value must be Cognito and the ProviderAttributeName must be Cognito_Subject. The ProviderAttributeValue must be the name that is used in the user pool for the user.

The ProviderAttributeName must always be Cognito_Subject for social IdPs. The ProviderAttributeValue must always be the exact subject that was used when the user was originally linked as a source user.

For de-linking a SAML identity, there are two scenarios. If the linked identity has not yet been used to sign in, the ProviderAttributeName and ProviderAttributeValue must be the same values that were used for the SourceUser when the identities were originally linked using AdminLinkProviderForUser call. (If the linking was done with ProviderAttributeName set to Cognito_Subject, the same applies here). However, if the user has already signed in, the ProviderAttributeName must be Cognito_Subject and ProviderAttributeValue must be the subject of the SAML assertion.

Parameter Syntax

$result = $client->adminDisableProviderForUser([
    'User' => [ // REQUIRED
        'ProviderAttributeName' => '<string>',
        'ProviderAttributeValue' => '<string>',
        'ProviderName' => '<string>',
    ],
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

AliasExistsException:

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminDisableUser

$result = $client->adminDisableUser([/* ... */]);
$promise = $client->adminDisableUserAsync([/* ... */]);

Deactivates a user and revokes all access tokens for the user. A deactivated user can't sign in, but still appears in the responses to GetUser and ListUsers API requests.

Parameter Syntax

$result = $client->adminDisableUser([
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminEnableUser

$result = $client->adminEnableUser([/* ... */]);
$promise = $client->adminEnableUserAsync([/* ... */]);

Enables the specified user as an administrator. Works on any user.

Parameter Syntax

$result = $client->adminEnableUser([
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminForgetDevice

$result = $client->adminForgetDevice([/* ... */]);
$promise = $client->adminForgetDeviceAsync([/* ... */]);

Forgets the device, as an administrator.

Parameter Syntax

$result = $client->adminForgetDevice([
    'DeviceKey' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminGetDevice

$result = $client->adminGetDevice([/* ... */]);
$promise = $client->adminGetDeviceAsync([/* ... */]);

Gets the device, as an administrator.

Parameter Syntax

$result = $client->adminGetDevice([
    'DeviceKey' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Device' => [
        'DeviceAttributes' => [
            [
                'Name' => '<string>',
                'Value' => '<string>',
            ],
            // ...
        ],
        'DeviceCreateDate' => <DateTime>,
        'DeviceKey' => '<string>',
        'DeviceLastAuthenticatedDate' => <DateTime>,
        'DeviceLastModifiedDate' => <DateTime>,
    ],
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

AdminGetUser

$result = $client->adminGetUser([/* ... */]);
$promise = $client->adminGetUserAsync([/* ... */]);

Gets the specified user by user name in a user pool as an administrator. Works on any user.

Parameter Syntax

$result = $client->adminGetUser([
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Enabled' => true || false,
    'MFAOptions' => [
        [
            'AttributeName' => '<string>',
            'DeliveryMedium' => 'SMS|EMAIL',
        ],
        // ...
    ],
    'PreferredMfaSetting' => '<string>',
    'UserAttributes' => [
        [
            'Name' => '<string>',
            'Value' => '<string>',
        ],
        // ...
    ],
    'UserCreateDate' => <DateTime>,
    'UserLastModifiedDate' => <DateTime>,
    'UserMFASettingList' => ['<string>', ...],
    'UserStatus' => 'UNCONFIRMED|CONFIRMED|ARCHIVED|COMPROMISED|UNKNOWN|RESET_REQUIRED|FORCE_CHANGE_PASSWORD|EXTERNAL_PROVIDER',
    'Username' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminInitiateAuth

$result = $client->adminInitiateAuth([/* ... */]);
$promise = $client->adminInitiateAuthAsync([/* ... */]);

Initiates the authentication flow, as an administrator.

Parameter Syntax

$result = $client->adminInitiateAuth([
    'AnalyticsMetadata' => [
        'AnalyticsEndpointId' => '<string>',
    ],
    'AuthFlow' => 'USER_SRP_AUTH|REFRESH_TOKEN_AUTH|REFRESH_TOKEN|CUSTOM_AUTH|ADMIN_NO_SRP_AUTH|USER_PASSWORD_AUTH|ADMIN_USER_PASSWORD_AUTH', // REQUIRED
    'AuthParameters' => ['<string>', ...],
    'ClientId' => '<string>', // REQUIRED
    'ClientMetadata' => ['<string>', ...],
    'ContextData' => [
        'EncodedData' => '<string>',
        'HttpHeaders' => [ // REQUIRED
            [
                'headerName' => '<string>',
                'headerValue' => '<string>',
            ],
            // ...
        ],
        'IpAddress' => '<string>', // REQUIRED
        'ServerName' => '<string>', // REQUIRED
        'ServerPath' => '<string>', // REQUIRED
    ],
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'AuthenticationResult' => [
        'AccessToken' => '<string>',
        'ExpiresIn' => <integer>,
        'IdToken' => '<string>',
        'NewDeviceMetadata' => [
            'DeviceGroupKey' => '<string>',
            'DeviceKey' => '<string>',
        ],
        'RefreshToken' => '<string>',
        'TokenType' => '<string>',
    ],
    'ChallengeName' => 'SMS_MFA|EMAIL_OTP|SOFTWARE_TOKEN_MFA|SELECT_MFA_TYPE|MFA_SETUP|PASSWORD_VERIFIER|CUSTOM_CHALLENGE|DEVICE_SRP_AUTH|DEVICE_PASSWORD_VERIFIER|ADMIN_NO_SRP_AUTH|NEW_PASSWORD_REQUIRED',
    'ChallengeParameters' => ['<string>', ...],
    'Session' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

MFAMethodNotFoundException:

This exception is thrown when Amazon Cognito can't find a multi-factor authentication (MFA) method.

InvalidSmsRoleAccessPolicyException:

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

InvalidEmailRoleAccessPolicyException:

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

InvalidSmsRoleTrustRelationshipException:

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

AdminLinkProviderForUser

$result = $client->adminLinkProviderForUser([/* ... */]);
$promise = $client->adminLinkProviderForUserAsync([/* ... */]);

Links an existing user account in a user pool (DestinationUser) to an identity from an external IdP (SourceUser) based on a specified attribute name and value from the external IdP. This allows you to create a link from the existing user account to an external federated user identity that has not yet been used to sign in. You can then use the federated user identity to sign in as the existing user account.

For example, if there is an existing user with a username and password, this API links that user to a federated user identity. When the user signs in with a federated user identity, they sign in as the existing user account.

Parameter Syntax

$result = $client->adminLinkProviderForUser([
    'DestinationUser' => [ // REQUIRED
        'ProviderAttributeName' => '<string>',
        'ProviderAttributeValue' => '<string>',
        'ProviderName' => '<string>',
    ],
    'SourceUser' => [ // REQUIRED
        'ProviderAttributeName' => '<string>',
        'ProviderAttributeValue' => '<string>',
        'ProviderName' => '<string>',
    ],
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

AliasExistsException:

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminListDevices

$result = $client->adminListDevices([/* ... */]);
$promise = $client->adminListDevicesAsync([/* ... */]);

Lists devices, as an administrator.

Parameter Syntax

$result = $client->adminListDevices([
    'Limit' => <integer>,
    'PaginationToken' => '<string>',
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Devices' => [
        [
            'DeviceAttributes' => [
                [
                    'Name' => '<string>',
                    'Value' => '<string>',
                ],
                // ...
            ],
            'DeviceCreateDate' => <DateTime>,
            'DeviceKey' => '<string>',
            'DeviceLastAuthenticatedDate' => <DateTime>,
            'DeviceLastModifiedDate' => <DateTime>,
        ],
        // ...
    ],
    'PaginationToken' => '<string>',
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

AdminListGroupsForUser

$result = $client->adminListGroupsForUser([/* ... */]);
$promise = $client->adminListGroupsForUserAsync([/* ... */]);

Lists the groups that a user belongs to.

Parameter Syntax

$result = $client->adminListGroupsForUser([
    'Limit' => <integer>,
    'NextToken' => '<string>',
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Groups' => [
        [
            'CreationDate' => <DateTime>,
            'Description' => '<string>',
            'GroupName' => '<string>',
            'LastModifiedDate' => <DateTime>,
            'Precedence' => <integer>,
            'RoleArn' => '<string>',
            'UserPoolId' => '<string>',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminListUserAuthEvents

$result = $client->adminListUserAuthEvents([/* ... */]);
$promise = $client->adminListUserAuthEventsAsync([/* ... */]);

A history of user activity and any risks detected as part of Amazon Cognito advanced security.

Parameter Syntax

$result = $client->adminListUserAuthEvents([
    'MaxResults' => <integer>,
    'NextToken' => '<string>',
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'AuthEvents' => [
        [
            'ChallengeResponses' => [
                [
                    'ChallengeName' => 'Password|Mfa',
                    'ChallengeResponse' => 'Success|Failure',
                ],
                // ...
            ],
            'CreationDate' => <DateTime>,
            'EventContextData' => [
                'City' => '<string>',
                'Country' => '<string>',
                'DeviceName' => '<string>',
                'IpAddress' => '<string>',
                'Timezone' => '<string>',
            ],
            'EventFeedback' => [
                'FeedbackDate' => <DateTime>,
                'FeedbackValue' => 'Valid|Invalid',
                'Provider' => '<string>',
            ],
            'EventId' => '<string>',
            'EventResponse' => 'Pass|Fail|InProgress',
            'EventRisk' => [
                'CompromisedCredentialsDetected' => true || false,
                'RiskDecision' => 'NoRisk|AccountTakeover|Block',
                'RiskLevel' => 'Low|Medium|High',
            ],
            'EventType' => 'SignIn|SignUp|ForgotPassword|PasswordChange|ResendCode',
        ],
        // ...
    ],
    'NextToken' => '<string>',
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserPoolAddOnNotEnabledException:

This exception is thrown when user pool add-ons aren't enabled.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminRemoveUserFromGroup

$result = $client->adminRemoveUserFromGroup([/* ... */]);
$promise = $client->adminRemoveUserFromGroupAsync([/* ... */]);

Removes the specified user from the specified group.

Parameter Syntax

$result = $client->adminRemoveUserFromGroup([
    'GroupName' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminResetUserPassword

$result = $client->adminResetUserPassword([/* ... */]);
$promise = $client->adminResetUserPasswordAsync([/* ... */]);

Resets the specified user's password in a user pool as an administrator. Works on any user.

To use this API operation, your user pool must have self-service account recovery configured. Use AdminSetUserPassword if you manage passwords as an administrator.

Deactivates a user's password, requiring them to change it. If a user tries to sign in after the API is called, Amazon Cognito responds with a PasswordResetRequiredException error. Your app must then perform the actions that reset your user's password: the forgot-password flow. In addition, if the user pool has phone verification selected and a verified phone number exists for the user, or if email verification is selected and a verified email exists for the user, calling this API will also result in sending a message to the end user with the code to change their password.

Parameter Syntax

$result = $client->adminResetUserPassword([
    'ClientMetadata' => ['<string>', ...],
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

UserNotFoundException:

This exception is thrown when a user isn't found.

InvalidSmsRoleAccessPolicyException:

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

InvalidEmailRoleAccessPolicyException:

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

InvalidSmsRoleTrustRelationshipException:

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminRespondToAuthChallenge

$result = $client->adminRespondToAuthChallenge([/* ... */]);
$promise = $client->adminRespondToAuthChallengeAsync([/* ... */]);

Some API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge. An AdminRespondToAuthChallenge API request provides the answer to that challenge, like a code or a secure remote password (SRP). The parameters of a response to an authentication challenge vary with the type of challenge.

For more information about custom authentication challenges, see Custom authentication challenge Lambda triggers.

Parameter Syntax

$result = $client->adminRespondToAuthChallenge([
    'AnalyticsMetadata' => [
        'AnalyticsEndpointId' => '<string>',
    ],
    'ChallengeName' => 'SMS_MFA|EMAIL_OTP|SOFTWARE_TOKEN_MFA|SELECT_MFA_TYPE|MFA_SETUP|PASSWORD_VERIFIER|CUSTOM_CHALLENGE|DEVICE_SRP_AUTH|DEVICE_PASSWORD_VERIFIER|ADMIN_NO_SRP_AUTH|NEW_PASSWORD_REQUIRED', // REQUIRED
    'ChallengeResponses' => ['<string>', ...],
    'ClientId' => '<string>', // REQUIRED
    'ClientMetadata' => ['<string>', ...],
    'ContextData' => [
        'EncodedData' => '<string>',
        'HttpHeaders' => [ // REQUIRED
            [
                'headerName' => '<string>',
                'headerValue' => '<string>',
            ],
            // ...
        ],
        'IpAddress' => '<string>', // REQUIRED
        'ServerName' => '<string>', // REQUIRED
        'ServerPath' => '<string>', // REQUIRED
    ],
    'Session' => '<string>',
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'AuthenticationResult' => [
        'AccessToken' => '<string>',
        'ExpiresIn' => <integer>,
        'IdToken' => '<string>',
        'NewDeviceMetadata' => [
            'DeviceGroupKey' => '<string>',
            'DeviceKey' => '<string>',
        ],
        'RefreshToken' => '<string>',
        'TokenType' => '<string>',
    ],
    'ChallengeName' => 'SMS_MFA|EMAIL_OTP|SOFTWARE_TOKEN_MFA|SELECT_MFA_TYPE|MFA_SETUP|PASSWORD_VERIFIER|CUSTOM_CHALLENGE|DEVICE_SRP_AUTH|DEVICE_PASSWORD_VERIFIER|ADMIN_NO_SRP_AUTH|NEW_PASSWORD_REQUIRED',
    'ChallengeParameters' => ['<string>', ...],
    'Session' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

CodeMismatchException:

This exception is thrown if the provided code doesn't match what the server was expecting.

ExpiredCodeException:

This exception is thrown if a code has expired.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

InvalidPasswordException:

This exception is thrown when Amazon Cognito encounters an invalid password.

PasswordHistoryPolicyViolationException:

The message returned when a user's new password matches a previous password and doesn't comply with the password-history policy.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

MFAMethodNotFoundException:

This exception is thrown when Amazon Cognito can't find a multi-factor authentication (MFA) method.

InvalidEmailRoleAccessPolicyException:

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

InvalidSmsRoleAccessPolicyException:

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

InvalidSmsRoleTrustRelationshipException:

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

AliasExistsException:

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

SoftwareTokenMFANotFoundException:

This exception is thrown when the software token time-based one-time password (TOTP) multi-factor authentication (MFA) isn't activated for the user pool.

AdminSetUserMFAPreference

$result = $client->adminSetUserMFAPreference([/* ... */]);
$promise = $client->adminSetUserMFAPreferenceAsync([/* ... */]);

Sets the user's multi-factor authentication (MFA) preference, including which MFA options are activated, and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in.

Parameter Syntax

$result = $client->adminSetUserMFAPreference([
    'EmailMfaSettings' => [
        'Enabled' => true || false,
        'PreferredMfa' => true || false,
    ],
    'SMSMfaSettings' => [
        'Enabled' => true || false,
        'PreferredMfa' => true || false,
    ],
    'SoftwareTokenMfaSettings' => [
        'Enabled' => true || false,
        'PreferredMfa' => true || false,
    ],
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminSetUserPassword

$result = $client->adminSetUserPassword([/* ... */]);
$promise = $client->adminSetUserPasswordAsync([/* ... */]);

Sets the specified user's password in a user pool as an administrator. Works on any user.

The password can be temporary or permanent. If it is temporary, the user status enters the FORCE_CHANGE_PASSWORD state. When the user next tries to sign in, the InitiateAuth/AdminInitiateAuth response will contain the NEW_PASSWORD_REQUIRED challenge. If the user doesn't sign in before it expires, the user won't be able to sign in, and an administrator must reset their password.

Once the user has set a new password, or the password is permanent, the user status is set to Confirmed.

AdminSetUserPassword can set a password for the user profile that Amazon Cognito creates for third-party federated users. When you set a password, the federated user's status changes from EXTERNAL_PROVIDER to CONFIRMED. A user in this state can sign in as a federated user, and initiate authentication flows in the API like a linked native user. They can also modify their password and attributes in token-authenticated API requests like ChangePassword and UpdateUserAttributes. As a best security practice and to keep users in sync with your external IdP, don't set passwords on federated user profiles. To set up a federated user for native sign-in with a linked native user, refer to Linking federated users to an existing user profile.

Parameter Syntax

$result = $client->adminSetUserPassword([
    'Password' => '<string>', // REQUIRED
    'Permanent' => true || false,
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

InvalidPasswordException:

This exception is thrown when Amazon Cognito encounters an invalid password.

PasswordHistoryPolicyViolationException:

The message returned when a user's new password matches a previous password and doesn't comply with the password-history policy.

AdminSetUserSettings

$result = $client->adminSetUserSettings([/* ... */]);
$promise = $client->adminSetUserSettingsAsync([/* ... */]);

This action is no longer supported. You can use it to configure only SMS MFA. You can't use it to configure time-based one-time password (TOTP) software token MFA. To configure either type of MFA, use AdminSetUserMFAPreference instead.

Parameter Syntax

$result = $client->adminSetUserSettings([
    'MFAOptions' => [ // REQUIRED
        [
            'AttributeName' => '<string>',
            'DeliveryMedium' => 'SMS|EMAIL',
        ],
        // ...
    ],
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminUpdateAuthEventFeedback

$result = $client->adminUpdateAuthEventFeedback([/* ... */]);
$promise = $client->adminUpdateAuthEventFeedbackAsync([/* ... */]);

Provides feedback for an authentication event indicating if it was from a valid user. This feedback is used for improving the risk evaluation decision for the user pool as part of Amazon Cognito advanced security.

Parameter Syntax

$result = $client->adminUpdateAuthEventFeedback([
    'EventId' => '<string>', // REQUIRED
    'FeedbackValue' => 'Valid|Invalid', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserPoolAddOnNotEnabledException:

This exception is thrown when user pool add-ons aren't enabled.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminUpdateDeviceStatus

$result = $client->adminUpdateDeviceStatus([/* ... */]);
$promise = $client->adminUpdateDeviceStatusAsync([/* ... */]);

Updates the device status as an administrator.

Parameter Syntax

$result = $client->adminUpdateDeviceStatus([
    'DeviceKey' => '<string>', // REQUIRED
    'DeviceRememberedStatus' => 'remembered|not_remembered',
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AdminUpdateUserAttributes

$result = $client->adminUpdateUserAttributes([/* ... */]);
$promise = $client->adminUpdateUserAttributesAsync([/* ... */]);

This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers require you to register an origination phone number before you can send SMS messages to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a phone number with Amazon Pinpoint. Amazon Cognito uses the registered number automatically. Otherwise, Amazon Cognito users who must receive SMS messages might not be able to sign up, activate their accounts, or sign in.

If you have never used SMS text messages with Amazon Cognito or any other Amazon Web Servicesservice, Amazon Simple Notification Service might place your account in the SMS sandbox. In sandbox mode , you can send messages only to verified phone numbers. After you test your app while in the sandbox environment, you can move out of the sandbox and into production. For more information, see SMS message settings for Amazon Cognito user pools in the Amazon Cognito Developer Guide.

Updates the specified user's attributes, including developer attributes, as an administrator. Works on any user. To delete an attribute from your user, submit the attribute in your API request with a blank value.

For custom attributes, you must prepend the custom: prefix to the attribute name.

In addition to updating user attributes, this API can also be used to mark phone and email as verified.

Parameter Syntax

$result = $client->adminUpdateUserAttributes([
    'ClientMetadata' => ['<string>', ...],
    'UserAttributes' => [ // REQUIRED
        [
            'Name' => '<string>', // REQUIRED
            'Value' => '<string>',
        ],
        // ...
    ],
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

AliasExistsException:

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

InvalidSmsRoleAccessPolicyException:

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

InvalidEmailRoleAccessPolicyException:

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

InvalidSmsRoleTrustRelationshipException:

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

AdminUserGlobalSignOut

$result = $client->adminUserGlobalSignOut([/* ... */]);
$promise = $client->adminUserGlobalSignOutAsync([/* ... */]);

Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation with your administrative credentials when your user signs out of your app. This results in the following behavior.

• Amazon Cognito no longer accepts token-authorized user operations that you authorize with a signed-out user's access tokens. For more information, see Using the Amazon Cognito user pools API and user pool endpoints.

  Amazon Cognito returns an Access Token has been revoked error when your app attempts to authorize a user pools API request with a revoked access token that contains the scope aws.cognito.signin.user.admin.

• Amazon Cognito no longer accepts a signed-out user's ID token in a GetId request to an identity pool with ServerSideTokenCheck enabled for its user pool IdP configuration in CognitoIdentityProvider.

• Amazon Cognito no longer accepts a signed-out user's refresh tokens in refresh requests.

Other requests might be valid until your user's token expires.

Parameter Syntax

$result = $client->adminUserGlobalSignOut([
    'UserPoolId' => '<string>', // REQUIRED
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

AssociateSoftwareToken

$result = $client->associateSoftwareToken([/* ... */]);
$promise = $client->associateSoftwareTokenAsync([/* ... */]);

Begins setup of time-based one-time password (TOTP) multi-factor authentication (MFA) for a user, with a unique private key that Amazon Cognito generates and returns in the API response. You can authorize an AssociateSoftwareToken request with either the user's access token, or a session string from a challenge response that you received from Amazon Cognito.

Parameter Syntax

$result = $client->associateSoftwareToken([
    'AccessToken' => '<string>',
    'Session' => '<string>',
]);

Parameter Details

Result Syntax

[
    'SecretCode' => '<string>',
    'Session' => '<string>',
]

Result Details

Errors

ConcurrentModificationException:

This exception is thrown if two or more modifications are happening concurrently.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

SoftwareTokenMFANotFoundException:

This exception is thrown when the software token time-based one-time password (TOTP) multi-factor authentication (MFA) isn't activated for the user pool.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

ChangePassword

$result = $client->changePassword([/* ... */]);
$promise = $client->changePasswordAsync([/* ... */]);

Changes the password for a specified user in a user pool.

Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Parameter Syntax

$result = $client->changePassword([
    'AccessToken' => '<string>', // REQUIRED
    'PreviousPassword' => '<string>', // REQUIRED
    'ProposedPassword' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

InvalidPasswordException:

This exception is thrown when Amazon Cognito encounters an invalid password.

PasswordHistoryPolicyViolationException:

The message returned when a user's new password matches a previous password and doesn't comply with the password-history policy.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

ConfirmDevice

$result = $client->confirmDevice([/* ... */]);
$promise = $client->confirmDeviceAsync([/* ... */]);

Confirms tracking of the device. This API call is the call that begins device tracking. For more information about device authentication, see Working with user devices in your user pool.

Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Parameter Syntax

$result = $client->confirmDevice([
    'AccessToken' => '<string>', // REQUIRED
    'DeviceKey' => '<string>', // REQUIRED
    'DeviceName' => '<string>',
    'DeviceSecretVerifierConfig' => [
        'PasswordVerifier' => '<string>',
        'Salt' => '<string>',
    ],
]);

Parameter Details

Result Syntax

[
    'UserConfirmationNecessary' => true || false,
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

InvalidPasswordException:

This exception is thrown when Amazon Cognito encounters an invalid password.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

UsernameExistsException:

This exception is thrown when Amazon Cognito encounters a user name that already exists in the user pool.

InvalidUserPoolConfigurationException:

This exception is thrown when the user pool configuration is not valid.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

ConfirmForgotPassword

$result = $client->confirmForgotPassword([/* ... */]);
$promise = $client->confirmForgotPasswordAsync([/* ... */]);

Allows a user to enter a confirmation code to reset a forgotten password.

Parameter Syntax

$result = $client->confirmForgotPassword([
    'AnalyticsMetadata' => [
        'AnalyticsEndpointId' => '<string>',
    ],
    'ClientId' => '<string>', // REQUIRED
    'ClientMetadata' => ['<string>', ...],
    'ConfirmationCode' => '<string>', // REQUIRED
    'Password' => '<string>', // REQUIRED
    'SecretHash' => '<string>',
    'UserContextData' => [
        'EncodedData' => '<string>',
        'IpAddress' => '<string>',
    ],
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

InvalidPasswordException:

This exception is thrown when Amazon Cognito encounters an invalid password.

PasswordHistoryPolicyViolationException:

The message returned when a user's new password matches a previous password and doesn't comply with the password-history policy.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

CodeMismatchException:

This exception is thrown if the provided code doesn't match what the server was expecting.

ExpiredCodeException:

This exception is thrown if a code has expired.

TooManyFailedAttemptsException:

This exception is thrown when the user has made too many failed attempts for a given action, such as sign-in.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

ConfirmSignUp

$result = $client->confirmSignUp([/* ... */]);
$promise = $client->confirmSignUpAsync([/* ... */]);

This public API operation provides a code that Amazon Cognito sent to your user when they signed up in your user pool via the SignUp API operation. After your user enters their code, they confirm ownership of the email address or phone number that they provided, and their user account becomes active. Depending on your user pool configuration, your users will receive their confirmation code in an email or SMS message.

Local users who signed up in your user pool are the only type of user who can confirm sign-up with a code. Users who federate through an external identity provider (IdP) have already been confirmed by their IdP. Administrator-created users, users created with the AdminCreateUser API operation, confirm their accounts when they respond to their invitation email message and choose a password. They do not receive a confirmation code. Instead, they receive a temporary password.

Parameter Syntax

$result = $client->confirmSignUp([
    'AnalyticsMetadata' => [
        'AnalyticsEndpointId' => '<string>',
    ],
    'ClientId' => '<string>', // REQUIRED
    'ClientMetadata' => ['<string>', ...],
    'ConfirmationCode' => '<string>', // REQUIRED
    'ForceAliasCreation' => true || false,
    'SecretHash' => '<string>',
    'UserContextData' => [
        'EncodedData' => '<string>',
        'IpAddress' => '<string>',
    ],
    'Username' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

UnexpectedLambdaException:

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

UserLambdaValidationException:

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyFailedAttemptsException:

This exception is thrown when the user has made too many failed attempts for a given action, such as sign-in.

CodeMismatchException:

This exception is thrown if the provided code doesn't match what the server was expecting.

ExpiredCodeException:

This exception is thrown if a code has expired.

InvalidLambdaResponseException:

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

AliasExistsException:

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

UserNotFoundException:

This exception is thrown when a user isn't found.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

CreateGroup

$result = $client->createGroup([/* ... */]);
$promise = $client->createGroupAsync([/* ... */]);

Creates a new group in the specified user pool.

Parameter Syntax

$result = $client->createGroup([
    'Description' => '<string>',
    'GroupName' => '<string>', // REQUIRED
    'Precedence' => <integer>,
    'RoleArn' => '<string>',
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'Group' => [
        'CreationDate' => <DateTime>,
        'Description' => '<string>',
        'GroupName' => '<string>',
        'LastModifiedDate' => <DateTime>,
        'Precedence' => <integer>,
        'RoleArn' => '<string>',
        'UserPoolId' => '<string>',
    ],
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

GroupExistsException:

This exception is thrown when Amazon Cognito encounters a group that already exists in the user pool.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

CreateIdentityProvider

$result = $client->createIdentityProvider([/* ... */]);
$promise = $client->createIdentityProviderAsync([/* ... */]);

Adds a configuration and trust relationship between a third-party identity provider (IdP) and a user pool.

Parameter Syntax

$result = $client->createIdentityProvider([
    'AttributeMapping' => ['<string>', ...],
    'IdpIdentifiers' => ['<string>', ...],
    'ProviderDetails' => ['<string>', ...], // REQUIRED
    'ProviderName' => '<string>', // REQUIRED
    'ProviderType' => 'SAML|Facebook|Google|LoginWithAmazon|SignInWithApple|OIDC', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'IdentityProvider' => [
        'AttributeMapping' => ['<string>', ...],
        'CreationDate' => <DateTime>,
        'IdpIdentifiers' => ['<string>', ...],
        'LastModifiedDate' => <DateTime>,
        'ProviderDetails' => ['<string>', ...],
        'ProviderName' => '<string>',
        'ProviderType' => 'SAML|Facebook|Google|LoginWithAmazon|SignInWithApple|OIDC',
        'UserPoolId' => '<string>',
    ],
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

DuplicateProviderException:

This exception is thrown when the provider is already supported by the user pool.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

CreateResourceServer

$result = $client->createResourceServer([/* ... */]);
$promise = $client->createResourceServerAsync([/* ... */]);

Creates a new OAuth2.0 resource server and defines custom scopes within it.

Parameter Syntax

$result = $client->createResourceServer([
    'Identifier' => '<string>', // REQUIRED
    'Name' => '<string>', // REQUIRED
    'Scopes' => [
        [
            'ScopeDescription' => '<string>', // REQUIRED
            'ScopeName' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'ResourceServer' => [
        'Identifier' => '<string>',
        'Name' => '<string>',
        'Scopes' => [
            [
                'ScopeDescription' => '<string>',
                'ScopeName' => '<string>',
            ],
            // ...
        ],
        'UserPoolId' => '<string>',
    ],
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

CreateUserImportJob

$result = $client->createUserImportJob([/* ... */]);
$promise = $client->createUserImportJobAsync([/* ... */]);

Creates a user import job.

Parameter Syntax

$result = $client->createUserImportJob([
    'CloudWatchLogsRoleArn' => '<string>', // REQUIRED
    'JobName' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'UserImportJob' => [
        'CloudWatchLogsRoleArn' => '<string>',
        'CompletionDate' => <DateTime>,
        'CompletionMessage' => '<string>',
        'CreationDate' => <DateTime>,
        'FailedUsers' => <integer>,
        'ImportedUsers' => <integer>,
        'JobId' => '<string>',
        'JobName' => '<string>',
        'PreSignedUrl' => '<string>',
        'SkippedUsers' => <integer>,
        'StartDate' => <DateTime>,
        'Status' => 'Created|Pending|InProgress|Stopping|Expired|Stopped|Failed|Succeeded',
        'UserPoolId' => '<string>',
    ],
]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

PreconditionNotMetException:

This exception is thrown when a precondition is not met.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

CreateUserPool

$result = $client->createUserPool([/* ... */]);
$promise = $client->createUserPoolAsync([/* ... */]);

This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers require you to register an origination phone number before you can send SMS messages to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a phone number with Amazon Pinpoint. Amazon Cognito uses the registered number automatically. Otherwise, Amazon Cognito users who must receive SMS messages might not be able to sign up, activate their accounts, or sign in.

If you have never used SMS text messages with Amazon Cognito or any other Amazon Web Servicesservice, Amazon Simple Notification Service might place your account in the SMS sandbox. In sandbox mode , you can send messages only to verified phone numbers. After you test your app while in the sandbox environment, you can move out of the sandbox and into production. For more information, see SMS message settings for Amazon Cognito user pools in the Amazon Cognito Developer Guide.

Creates a new Amazon Cognito user pool and sets the password policy for the pool.

Parameter Syntax

$result = $client->createUserPool([
    'AccountRecoverySetting' => [
        'RecoveryMechanisms' => [
            [
                'Name' => 'verified_email|verified_phone_number|admin_only', // REQUIRED
                'Priority' => <integer>, // REQUIRED
            ],
            // ...
        ],
    ],
    'AdminCreateUserConfig' => [
        'AllowAdminCreateUserOnly' => true || false,
        'InviteMessageTemplate' => [
            'EmailMessage' => '<string>',
            'EmailSubject' => '<string>',
            'SMSMessage' => '<string>',
        ],
        'UnusedAccountValidityDays' => <integer>,
    ],
    'AliasAttributes' => ['<string>', ...],
    'AutoVerifiedAttributes' => ['<string>', ...],
    'DeletionProtection' => 'ACTIVE|INACTIVE',
    'DeviceConfiguration' => [
        'ChallengeRequiredOnNewDevice' => true || false,
        'DeviceOnlyRememberedOnUserPrompt' => true || false,
    ],
    'EmailConfiguration' => [
        'ConfigurationSet' => '<string>',
        'EmailSendingAccount' => 'COGNITO_DEFAULT|DEVELOPER',
        'From' => '<string>',
        'ReplyToEmailAddress' => '<string>',
        'SourceArn' => '<string>',
    ],
    'EmailVerificationMessage' => '<string>',
    'EmailVerificationSubject' => '<string>',
    'LambdaConfig' => [
        'CreateAuthChallenge' => '<string>',
        'CustomEmailSender' => [
            'LambdaArn' => '<string>', // REQUIRED
            'LambdaVersion' => 'V1_0', // REQUIRED
        ],
        'CustomMessage' => '<string>',
        'CustomSMSSender' => [
            'LambdaArn' => '<string>', // REQUIRED
            'LambdaVersion' => 'V1_0', // REQUIRED
        ],
        'DefineAuthChallenge' => '<string>',
        'KMSKeyID' => '<string>',
        'PostAuthentication' => '<string>',
        'PostConfirmation' => '<string>',
        'PreAuthentication' => '<string>',
        'PreSignUp' => '<string>',
        'PreTokenGeneration' => '<string>',
        'PreTokenGenerationConfig' => [
            'LambdaArn' => '<string>', // REQUIRED
            'LambdaVersion' => 'V1_0|V2_0', // REQUIRED
        ],
        'UserMigration' => '<string>',
        'VerifyAuthChallengeResponse' => '<string>',
    ],
    'MfaConfiguration' => 'OFF|ON|OPTIONAL',
    'Policies' => [
        'PasswordPolicy' => [
            'MinimumLength' => <integer>,
            'PasswordHistorySize' => <integer>,
            'RequireLowercase' => true || false,
            'RequireNumbers' => true || false,
            'RequireSymbols' => true || false,
            'RequireUppercase' => true || false,
            'TemporaryPasswordValidityDays' => <integer>,
        ],
    ],
    'PoolName' => '<string>', // REQUIRED
    'Schema' => [
        [
            'AttributeDataType' => 'String|Number|DateTime|Boolean',
            'DeveloperOnlyAttribute' => true || false,
            'Mutable' => true || false,
            'Name' => '<string>',
            'NumberAttributeConstraints' => [
                'MaxValue' => '<string>',
                'MinValue' => '<string>',
            ],
            'Required' => true || false,
            'StringAttributeConstraints' => [
                'MaxLength' => '<string>',
                'MinLength' => '<string>',
            ],
        ],
        // ...
    ],
    'SmsAuthenticationMessage' => '<string>',
    'SmsConfiguration' => [
        'ExternalId' => '<string>',
        'SnsCallerArn' => '<string>', // REQUIRED
        'SnsRegion' => '<string>',
    ],
    'SmsVerificationMessage' => '<string>',
    'UserAttributeUpdateSettings' => [
        'AttributesRequireVerificationBeforeUpdate' => ['<string>', ...],
    ],
    'UserPoolAddOns' => [
        'AdvancedSecurityAdditionalFlows' => [
            'CustomAuthMode' => 'AUDIT|ENFORCED',
        ],
        'AdvancedSecurityMode' => 'OFF|AUDIT|ENFORCED', // REQUIRED
    ],
    'UserPoolTags' => ['<string>', ...],
    'UsernameAttributes' => ['<string>', ...],
    'UsernameConfiguration' => [
        'CaseSensitive' => true || false, // REQUIRED
    ],
    'VerificationMessageTemplate' => [
        'DefaultEmailOption' => 'CONFIRM_WITH_LINK|CONFIRM_WITH_CODE',
        'EmailMessage' => '<string>',
        'EmailMessageByLink' => '<string>',
        'EmailSubject' => '<string>',
        'EmailSubjectByLink' => '<string>',
        'SmsMessage' => '<string>',
    ],
]);

Parameter Details

Result Syntax

[
    'UserPool' => [
        'AccountRecoverySetting' => [
            'RecoveryMechanisms' => [
                [
                    'Name' => 'verified_email|verified_phone_number|admin_only',
                    'Priority' => <integer>,
                ],
                // ...
            ],
        ],
        'AdminCreateUserConfig' => [
            'AllowAdminCreateUserOnly' => true || false,
            'InviteMessageTemplate' => [
                'EmailMessage' => '<string>',
                'EmailSubject' => '<string>',
                'SMSMessage' => '<string>',
            ],
            'UnusedAccountValidityDays' => <integer>,
        ],
        'AliasAttributes' => ['<string>', ...],
        'Arn' => '<string>',
        'AutoVerifiedAttributes' => ['<string>', ...],
        'CreationDate' => <DateTime>,
        'CustomDomain' => '<string>',
        'DeletionProtection' => 'ACTIVE|INACTIVE',
        'DeviceConfiguration' => [
            'ChallengeRequiredOnNewDevice' => true || false,
            'DeviceOnlyRememberedOnUserPrompt' => true || false,
        ],
        'Domain' => '<string>',
        'EmailConfiguration' => [
            'ConfigurationSet' => '<string>',
            'EmailSendingAccount' => 'COGNITO_DEFAULT|DEVELOPER',
            'From' => '<string>',
            'ReplyToEmailAddress' => '<string>',
            'SourceArn' => '<string>',
        ],
        'EmailConfigurationFailure' => '<string>',
        'EmailVerificationMessage' => '<string>',
        'EmailVerificationSubject' => '<string>',
        'EstimatedNumberOfUsers' => <integer>,
        'Id' => '<string>',
        'LambdaConfig' => [
            'CreateAuthChallenge' => '<string>',
            'CustomEmailSender' => [
                'LambdaArn' => '<string>',
                'LambdaVersion' => 'V1_0',
            ],
            'CustomMessage' => '<string>',
            'CustomSMSSender' => [
                'LambdaArn' => '<string>',
                'LambdaVersion' => 'V1_0',
            ],
            'DefineAuthChallenge' => '<string>',
            'KMSKeyID' => '<string>',
            'PostAuthentication' => '<string>',
            'PostConfirmation' => '<string>',
            'PreAuthentication' => '<string>',
            'PreSignUp' => '<string>',
            'PreTokenGeneration' => '<string>',
            'PreTokenGenerationConfig' => [
                'LambdaArn' => '<string>',
                'LambdaVersion' => 'V1_0|V2_0',
            ],
            'UserMigration' => '<string>',
            'VerifyAuthChallengeResponse' => '<string>',
        ],
        'LastModifiedDate' => <DateTime>,
        'MfaConfiguration' => 'OFF|ON|OPTIONAL',
        'Name' => '<string>',
        'Policies' => [
            'PasswordPolicy' => [
                'MinimumLength' => <integer>,
                'PasswordHistorySize' => <integer>,
                'RequireLowercase' => true || false,
                'RequireNumbers' => true || false,
                'RequireSymbols' => true || false,
                'RequireUppercase' => true || false,
                'TemporaryPasswordValidityDays' => <integer>,
            ],
        ],
        'SchemaAttributes' => [
            [
                'AttributeDataType' => 'String|Number|DateTime|Boolean',
                'DeveloperOnlyAttribute' => true || false,
                'Mutable' => true || false,
                'Name' => '<string>',
                'NumberAttributeConstraints' => [
                    'MaxValue' => '<string>',
                    'MinValue' => '<string>',
                ],
                'Required' => true || false,
                'StringAttributeConstraints' => [
                    'MaxLength' => '<string>',
                    'MinLength' => '<string>',
                ],
            ],
            // ...
        ],
        'SmsAuthenticationMessage' => '<string>',
        'SmsConfiguration' => [
            'ExternalId' => '<string>',
            'SnsCallerArn' => '<string>',
            'SnsRegion' => '<string>',
        ],
        'SmsConfigurationFailure' => '<string>',
        'SmsVerificationMessage' => '<string>',
        'Status' => 'Enabled|Disabled',
        'UserAttributeUpdateSettings' => [
            'AttributesRequireVerificationBeforeUpdate' => ['<string>', ...],
        ],
        'UserPoolAddOns' => [
            'AdvancedSecurityAdditionalFlows' => [
                'CustomAuthMode' => 'AUDIT|ENFORCED',
            ],
            'AdvancedSecurityMode' => 'OFF|AUDIT|ENFORCED',
        ],
        'UserPoolTags' => ['<string>', ...],
        'UsernameAttributes' => ['<string>', ...],
        'UsernameConfiguration' => [
            'CaseSensitive' => true || false,
        ],
        'VerificationMessageTemplate' => [
            'DefaultEmailOption' => 'CONFIRM_WITH_LINK|CONFIRM_WITH_CODE',
            'EmailMessage' => '<string>',
            'EmailMessageByLink' => '<string>',
            'EmailSubject' => '<string>',
            'EmailSubjectByLink' => '<string>',
            'SmsMessage' => '<string>',
        ],
    ],
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

InvalidSmsRoleAccessPolicyException:

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

InvalidSmsRoleTrustRelationshipException:

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

InvalidEmailRoleAccessPolicyException:

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserPoolTaggingException:

This exception is thrown when a user pool tag can't be set or updated.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

Examples

Example 1: Example user pool with email and username sign-in

The following example creates a user pool with all configurable properties set to an example value. The resulting user pool allows sign-in with username or email address, has optional MFA, and has a Lambda function assigned to each possible trigger.

$result = $client->createUserPool([
    'AccountRecoverySetting' => [
        'RecoveryMechanisms' => [
            [
                'Name' => 'verified_email',
                'Priority' => 1,
            ],
        ],
    ],
    'AdminCreateUserConfig' => [
        'AllowAdminCreateUserOnly' => ,
        'InviteMessageTemplate' => [
            'EmailMessage' => 'Your username is {username} and temporary password is {####}.',
            'EmailSubject' => 'Your sign-in information',
            'SMSMessage' => 'Your username is {username} and temporary password is {####}.',
        ],
    ],
    'AliasAttributes' => [
        'email',
    ],
    'AutoVerifiedAttributes' => [
        'email',
    ],
    'DeletionProtection' => 'ACTIVE',
    'DeviceConfiguration' => [
        'ChallengeRequiredOnNewDevice' => 1,
        'DeviceOnlyRememberedOnUserPrompt' => 1,
    ],
    'EmailConfiguration' => [
        'ConfigurationSet' => 'my-test-ses-configuration-set',
        'EmailSendingAccount' => 'DEVELOPER',
        'From' => 'support@example.com',
        'ReplyToEmailAddress' => 'support@example.com',
        'SourceArn' => 'arn:aws:ses:us-east-1:123456789012:identity/support@example.com',
    ],
    'EmailVerificationMessage' => 'Your verification code is {####}.',
    'EmailVerificationSubject' => 'Verify your email address',
    'LambdaConfig' => [
        'CustomEmailSender' => [
            'LambdaArn' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'LambdaVersion' => 'V1_0',
        ],
        'CustomMessage' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'CustomSMSSender' => [
            'LambdaArn' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'LambdaVersion' => 'V1_0',
        ],
        'DefineAuthChallenge' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'KMSKeyID' => 'arn:aws:kms:us-east-1:123456789012:key/a6c4f8e2-0c45-47db-925f-87854bc9e357',
        'PostAuthentication' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'PostConfirmation' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'PreAuthentication' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'PreSignUp' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'PreTokenGeneration' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'UserMigration' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        'VerifyAuthChallengeResponse' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
    ],
    'MfaConfiguration' => 'OPTIONAL',
    'Policies' => [
        'PasswordPolicy' => [
            'MinimumLength' => 6,
            'RequireLowercase' => 1,
            'RequireNumbers' => 1,
            'RequireSymbols' => 1,
            'RequireUppercase' => 1,
            'TemporaryPasswordValidityDays' => 7,
        ],
    ],
    'PoolName' => 'my-test-user-pool',
    'Schema' => [
        [
            'AttributeDataType' => 'Number',
            'DeveloperOnlyAttribute' => 1,
            'Mutable' => 1,
            'Name' => 'mydev',
            'NumberAttributeConstraints' => [
                'MaxValue' => '99',
                'MinValue' => '1',
            ],
            'Required' => ,
            'StringAttributeConstraints' => [
                'MaxLength' => '99',
                'MinLength' => '1',
            ],
        ],
    ],
    'SmsAuthenticationMessage' => 'Your verification code is {####}.',
    'SmsConfiguration' => [
        'ExternalId' => 'my-role-external-id',
        'SnsCallerArn' => 'arn:aws:iam::123456789012:role/service-role/test-cognito-SMS-Role',
    ],
    'SmsVerificationMessage' => 'Your verification code is {####}.',
    'UserAttributeUpdateSettings' => [
        'AttributesRequireVerificationBeforeUpdate' => [
            'email',
        ],
    ],
    'UserPoolAddOns' => [
        'AdvancedSecurityMode' => 'OFF',
    ],
    'UserPoolTags' => [
        'my-test-tag-key' => 'my-test-tag-key',
    ],
    'UsernameConfiguration' => [
        'CaseSensitive' => 1,
    ],
    'VerificationMessageTemplate' => [
        'DefaultEmailOption' => 'CONFIRM_WITH_CODE',
        'EmailMessage' => 'Your confirmation code is {####}',
        'EmailMessageByLink' => 'Choose this link to {##verify your email##}',
        'EmailSubject' => 'Here is your confirmation code',
        'EmailSubjectByLink' => 'Here is your confirmation link',
        'SmsMessage' => 'Your confirmation code is {####}',
    ],
]);

Result syntax:

[
    'UserPool' => [
        'AccountRecoverySetting' => [
            'RecoveryMechanisms' => [
                [
                    'Name' => 'verified_email',
                    'Priority' => 1,
                ],
            ],
        ],
        'AdminCreateUserConfig' => [
            'AllowAdminCreateUserOnly' => ,
            'InviteMessageTemplate' => [
                'EmailMessage' => 'Your username is {username} and temporary password is {####}.',
                'EmailSubject' => 'Your sign-in information',
                'SMSMessage' => 'Your username is {username} and temporary password is {####}.',
            ],
            'UnusedAccountValidityDays' => 7,
        ],
        'AliasAttributes' => [
            'email',
        ],
        'Arn' => 'arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_EXAMPLE',
        'AutoVerifiedAttributes' => [
            'email',
        ],
        'CreationDate' => ,
        'DeletionProtection' => 'ACTIVE',
        'DeviceConfiguration' => [
            'ChallengeRequiredOnNewDevice' => 1,
            'DeviceOnlyRememberedOnUserPrompt' => 1,
        ],
        'EmailConfiguration' => [
            'ConfigurationSet' => 'my-test-ses-configuration-set',
            'EmailSendingAccount' => 'DEVELOPER',
            'From' => 'support@example.com',
            'ReplyToEmailAddress' => 'support@example.com',
            'SourceArn' => 'arn:aws:ses:us-east-1:123456789012:identity/support@example.com',
        ],
        'EmailVerificationMessage' => 'Your verification code is {####}.',
        'EmailVerificationSubject' => 'Verify your email address',
        'EstimatedNumberOfUsers' => 0,
        'Id' => 'us-east-1_EXAMPLE',
        'LambdaConfig' => [
            'CustomEmailSender' => [
                'LambdaArn' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
                'LambdaVersion' => 'V1_0',
            ],
            'CustomMessage' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'CustomSMSSender' => [
                'LambdaArn' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
                'LambdaVersion' => 'V1_0',
            ],
            'DefineAuthChallenge' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'KMSKeyID' => 'arn:aws:kms:us-east-1:767671399759:key/4d43904c-8edf-4bb4-9fca-fb1a80e41cbe',
            'PostAuthentication' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'PostConfirmation' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'PreAuthentication' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'PreSignUp' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'PreTokenGeneration' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'UserMigration' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
            'VerifyAuthChallengeResponse' => 'arn:aws:lambda:us-east-1:123456789012:function:MyFunction',
        ],
        'LastModifiedDate' => ,
        'MfaConfiguration' => 'OPTIONAL',
        'Name' => 'my-test-user-pool',
        'Policies' => [
            'PasswordPolicy' => [
                'MinimumLength' => 6,
                'RequireLowercase' => 1,
                'RequireNumbers' => 1,
                'RequireSymbols' => 1,
                'RequireUppercase' => 1,
                'TemporaryPasswordValidityDays' => 7,
            ],
        ],
        'SchemaAttributes' => [
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => ,
                'Name' => 'sub',
                'Required' => 1,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '1',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'name',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'given_name',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'family_name',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'middle_name',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'nickname',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'preferred_username',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'profile',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'picture',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'website',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'email',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'Boolean',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'email_verified',
                'Required' => ,
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'gender',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'birthdate',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '10',
                    'MinLength' => '10',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'zoneinfo',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'locale',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'phone_number',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'Boolean',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'phone_number_verifie',
                'Required' => ,
            ],
            [
                'AttributeDataType' => 'String',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'address',
                'Required' => ,
                'StringAttributeConstraints' => [
                    'MaxLength' => '2048',
                    'MinLength' => '0',
                ],
            ],
            [
                'AttributeDataType' => 'Number',
                'DeveloperOnlyAttribute' => ,
                'Mutable' => 1,
                'Name' => 'updated_at',
                'NumberAttributeConstraints' => [
                    'MinValue' => '0',
                ],
                'Required' => ,
            ],
            [
                'AttributeDataType' => 'Number',
                'DeveloperOnlyAttribute' => 1,
                'Mutable' => 1,
                'Name' => 'dev:custom:mydev',
                'NumberAttributeConstraints' => [
                    'MaxValue' => '99',
                    'MinValue' => '1',
                ],
                'Required' => ,
            ],
        ],
        'SmsAuthenticationMessage' => 'Your verification code is {####}.',
        'SmsConfiguration' => [
            'ExternalId' => 'my-role-external-id',
            'SnsCallerArn' => 'arn:aws:iam::123456789012:role/service-role/test-cognito-SMS-Role',
            'SnsRegion' => 'us-east-1',
        ],
        'SmsVerificationMessage' => 'Your verification code is {####}.',
        'UserAttributeUpdateSettings' => [
            'AttributesRequireVerificationBeforeUpdate' => [
                'email',
            ],
        ],
        'UserPoolAddOns' => [
            'AdvancedSecurityMode' => 'OFF',
        ],
        'UserPoolTags' => [
            'my-test-tag-key' => 'my-test-tag-value',
        ],
        'UsernameConfiguration' => [
            'CaseSensitive' => 1,
        ],
        'VerificationMessageTemplate' => [
            'DefaultEmailOption' => 'CONFIRM_WITH_CODE',
            'EmailMessage' => 'Your confirmation code is {####}',
            'EmailMessageByLink' => 'Choose this link to {##verify your email##}',
            'EmailSubject' => 'Here is your confirmation code',
            'EmailSubjectByLink' => 'Here is your confirmation link',
            'SmsMessage' => 'Your confirmation code is {####}',
        ],
    ],
]

CreateUserPoolClient

$result = $client->createUserPoolClient([/* ... */]);
$promise = $client->createUserPoolClientAsync([/* ... */]);

Creates the user pool client.

When you create a new user pool client, token revocation is automatically activated. For more information about revoking tokens, see RevokeToken.

Parameter Syntax

$result = $client->createUserPoolClient([
    'AccessTokenValidity' => <integer>,
    'AllowedOAuthFlows' => ['<string>', ...],
    'AllowedOAuthFlowsUserPoolClient' => true || false,
    'AllowedOAuthScopes' => ['<string>', ...],
    'AnalyticsConfiguration' => [
        'ApplicationArn' => '<string>',
        'ApplicationId' => '<string>',
        'ExternalId' => '<string>',
        'RoleArn' => '<string>',
        'UserDataShared' => true || false,
    ],
    'AuthSessionValidity' => <integer>,
    'CallbackURLs' => ['<string>', ...],
    'ClientName' => '<string>', // REQUIRED
    'DefaultRedirectURI' => '<string>',
    'EnablePropagateAdditionalUserContextData' => true || false,
    'EnableTokenRevocation' => true || false,
    'ExplicitAuthFlows' => ['<string>', ...],
    'GenerateSecret' => true || false,
    'IdTokenValidity' => <integer>,
    'LogoutURLs' => ['<string>', ...],
    'PreventUserExistenceErrors' => 'LEGACY|ENABLED',
    'ReadAttributes' => ['<string>', ...],
    'RefreshTokenValidity' => <integer>,
    'SupportedIdentityProviders' => ['<string>', ...],
    'TokenValidityUnits' => [
        'AccessToken' => 'seconds|minutes|hours|days',
        'IdToken' => 'seconds|minutes|hours|days',
        'RefreshToken' => 'seconds|minutes|hours|days',
    ],
    'UserPoolId' => '<string>', // REQUIRED
    'WriteAttributes' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'UserPoolClient' => [
        'AccessTokenValidity' => <integer>,
        'AllowedOAuthFlows' => ['<string>', ...],
        'AllowedOAuthFlowsUserPoolClient' => true || false,
        'AllowedOAuthScopes' => ['<string>', ...],
        'AnalyticsConfiguration' => [
            'ApplicationArn' => '<string>',
            'ApplicationId' => '<string>',
            'ExternalId' => '<string>',
            'RoleArn' => '<string>',
            'UserDataShared' => true || false,
        ],
        'AuthSessionValidity' => <integer>,
        'CallbackURLs' => ['<string>', ...],
        'ClientId' => '<string>',
        'ClientName' => '<string>',
        'ClientSecret' => '<string>',
        'CreationDate' => <DateTime>,
        'DefaultRedirectURI' => '<string>',
        'EnablePropagateAdditionalUserContextData' => true || false,
        'EnableTokenRevocation' => true || false,
        'ExplicitAuthFlows' => ['<string>', ...],
        'IdTokenValidity' => <integer>,
        'LastModifiedDate' => <DateTime>,
        'LogoutURLs' => ['<string>', ...],
        'PreventUserExistenceErrors' => 'LEGACY|ENABLED',
        'ReadAttributes' => ['<string>', ...],
        'RefreshTokenValidity' => <integer>,
        'SupportedIdentityProviders' => ['<string>', ...],
        'TokenValidityUnits' => [
            'AccessToken' => 'seconds|minutes|hours|days',
            'IdToken' => 'seconds|minutes|hours|days',
            'RefreshToken' => 'seconds|minutes|hours|days',
        ],
        'UserPoolId' => '<string>',
        'WriteAttributes' => ['<string>', ...],
    ],
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

ScopeDoesNotExistException:

This exception is thrown when the specified scope doesn't exist.

InvalidOAuthFlowException:

This exception is thrown when the specified OAuth flow is not valid.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

Examples

Example 1: Example user pool app client with email and username sign-in

The following example creates an app client with all configurable properties set to an example value. The resulting user pool client connects to an analytics client, allows sign-in with username and password, and has two external identity providers associated with it.

$result = $client->createUserPoolClient([
    'AccessTokenValidity' => 6,
    'AllowedOAuthFlows' => [
        'code',
    ],
    'AllowedOAuthFlowsUserPoolClient' => 1,
    'AllowedOAuthScopes' => [
        'aws.cognito.signin.user.admin',
        'openid',
    ],
    'AnalyticsConfiguration' => [
        'ApplicationId' => 'd70b2ba36a8c4dc5a04a0451a31a1e12',
        'ExternalId' => 'my-external-id',
        'RoleArn' => 'arn:aws:iam::123456789012:role/test-cognitouserpool-role',
        'UserDataShared' => 1,
    ],
    'CallbackURLs' => [
        'https://example.com',
        'http://localhost',
        'myapp://example',
    ],
    'ClientName' => 'my-test-app-client',
    'DefaultRedirectURI' => 'https://example.com',
    'ExplicitAuthFlows' => [
        'ALLOW_ADMIN_USER_PASSWORD_AUTH',
        'ALLOW_USER_PASSWORD_AUTH',
        'ALLOW_REFRESH_TOKEN_AUTH',
    ],
    'GenerateSecret' => 1,
    'IdTokenValidity' => 6,
    'LogoutURLs' => [
        'https://example.com/logout',
    ],
    'PreventUserExistenceErrors' => 'ENABLED',
    'ReadAttributes' => [
        'email',
        'address',
        'preferred_username',
    ],
    'RefreshTokenValidity' => 6,
    'SupportedIdentityProviders' => [
        'SignInWithApple',
        'MySSO',
    ],
    'TokenValidityUnits' => [
        'AccessToken' => 'hours',
        'IdToken' => 'minutes',
        'RefreshToken' => 'days',
    ],
    'UserPoolId' => 'us-east-1_EXAMPLE',
    'WriteAttributes' => [
        'family_name',
        'email',
    ],
]);

Result syntax:

[
    'UserPoolClient' => [
        'AccessTokenValidity' => 6,
        'AllowedOAuthFlows' => [
            'code',
        ],
        'AllowedOAuthFlowsUserPoolClient' => 1,
        'AllowedOAuthScopes' => [
            'aws.cognito.signin.user.admin',
            'openid',
        ],
        'AnalyticsConfiguration' => [
            'ApplicationId' => 'd70b2ba36a8c4dc5a04a0451a31a1e12',
            'ExternalId' => 'my-external-id',
            'RoleArn' => 'arn:aws:iam::123456789012:role/test-cognitouserpool-role',
            'UserDataShared' => 1,
        ],
        'AuthSessionValidity' => 3,
        'CallbackURLs' => [
            'https://example.com',
            'http://localhost',
            'myapp://example',
        ],
        'ClientId' => '26cb2c60kq7nbmas7rbme9b6pp',
        'ClientName' => 'my-test-app-client',
        'ClientSecret' => '13ka4h7u28d9oo44tqpq9djqsfvhvu8rk4d2ighvpu0k8fj1c2r9',
        'CreationDate' => ,
        'DefaultRedirectURI' => 'https://example.com',
        'EnablePropagateAdditionalUserContextData' => ,
        'EnableTokenRevocation' => 1,
        'ExplicitAuthFlows' => [
            'ALLOW_USER_PASSWORD_AUTH',
            'ALLOW_ADMIN_USER_PASSWORD_AUTH',
            'ALLOW_REFRESH_TOKEN_AUTH',
        ],
        'IdTokenValidity' => 6,
        'LastModifiedDate' => ,
        'LogoutURLs' => [
            'https://example.com/logout',
        ],
        'PreventUserExistenceErrors' => 'ENABLED',
        'ReadAttributes' => [
            'address',
            'preferred_username',
            'email',
        ],
        'RefreshTokenValidity' => 6,
        'SupportedIdentityProviders' => [
            'SignInWithApple',
            'MySSO',
        ],
        'TokenValidityUnits' => [
            'AccessToken' => 'hours',
            'IdToken' => 'minutes',
            'RefreshToken' => 'days',
        ],
        'UserPoolId' => 'us-east-1_EXAMPLE',
        'WriteAttributes' => [
            'family_name',
            'email',
        ],
    ],
]

CreateUserPoolDomain

$result = $client->createUserPoolDomain([/* ... */]);
$promise = $client->createUserPoolDomainAsync([/* ... */]);

Creates a new domain for a user pool.

Parameter Syntax

$result = $client->createUserPoolDomain([
    'CustomDomainConfig' => [
        'CertificateArn' => '<string>', // REQUIRED
    ],
    'Domain' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'CloudFrontDomain' => '<string>',
]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

LimitExceededException:

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

DeleteGroup

$result = $client->deleteGroup([/* ... */]);
$promise = $client->deleteGroupAsync([/* ... */]);

Deletes a group.

Calling this action requires developer credentials.

Parameter Syntax

$result = $client->deleteGroup([
    'GroupName' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

DeleteIdentityProvider

$result = $client->deleteIdentityProvider([/* ... */]);
$promise = $client->deleteIdentityProviderAsync([/* ... */]);

Deletes an IdP for a user pool.

Parameter Syntax

$result = $client->deleteIdentityProvider([
    'ProviderName' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

UnsupportedIdentityProviderException:

This exception is thrown when the specified identifier isn't supported.

ConcurrentModificationException:

This exception is thrown if two or more modifications are happening concurrently.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

DeleteResourceServer

$result = $client->deleteResourceServer([/* ... */]);
$promise = $client->deleteResourceServerAsync([/* ... */]);

Deletes a resource server.

Parameter Syntax

$result = $client->deleteResourceServer([
    'Identifier' => '<string>', // REQUIRED
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

DeleteUser

$result = $client->deleteUser([/* ... */]);
$promise = $client->deleteUserAsync([/* ... */]);

Allows a user to delete their own user profile.

Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Parameter Syntax

$result = $client->deleteUser([
    'AccessToken' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

DeleteUserAttributes

$result = $client->deleteUserAttributes([/* ... */]);
$promise = $client->deleteUserAttributesAsync([/* ... */]);

Deletes the attributes for a user.

Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.

Parameter Syntax

$result = $client->deleteUserAttributes([
    'AccessToken' => '<string>', // REQUIRED
    'UserAttributeNames' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

PasswordResetRequiredException:

This exception is thrown when a password reset is required.

UserNotFoundException:

This exception is thrown when a user isn't found.

UserNotConfirmedException:

This exception is thrown when a user isn't confirmed successfully.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.

ForbiddenException:

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

DeleteUserPool

$result = $client->deleteUserPool([/* ... */]);
$promise = $client->deleteUserPoolAsync([/* ... */]);

Deletes the specified Amazon Cognito user pool.

Parameter Syntax

$result = $client->deleteUserPool([
    'UserPoolId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

This exception is thrown when the Amazon Cognito service can't find the requested resource.

InvalidParameterException:

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

TooManyRequestsException:

This exception is thrown when the user has made too many requests for a given operation.

NotAuthorizedException:

This exception is thrown when a user isn't authorized.

UserImportInProgressException:

This exception is thrown when you're trying to modify a user pool while a user import job is in progress for that pool.

InternalErrorException:

This exception is thrown when Amazon Cognito encounters an internal error.