aws cognito-idp
With the Amazon Cognito user pools API, you can configure user pools and authenticate users. AWS CLI reference
132 commands Its page in the AWS CLI reference
Commands
add-custom-attributesAdds additional user attributes to the user pool schema.add-user-pool-client-secretCreates a new client secret for an existing confidential user pool app client.admin-add-user-to-groupAdds a user to a group.admin-confirm-sign-upConfirms user sign-up as an administrator.admin-create-userCreates a new user in the specified user pool.admin-delete-software-tokenDeletes a user's registered time-based one-time password (TOTP) multi-factor authentication (MFA) factor, also known as a software token.admin-delete-userDeletes a user profile in your user pool.admin-delete-user-attributesDeletes attribute values from a user.admin-disable-provider-for-userPrevents the user from signing in with the specified external (SAML or social) identity provider (IdP).admin-disable-userDeactivates a user profile and revokes all access tokens for the user.admin-enable-userActivates sign-in for a user profile that previously had sign-in access disabled.admin-forget-deviceForgets, or deletes, a remembered device from a user's profile.admin-get-deviceGiven the device key, returns details for a user's device.admin-get-userGiven a username, returns details about a user profile in a user pool.admin-get-user-auth-factorsLists the authentication options for a user in a user pool.admin-initiate-authStarts sign-in for applications with a server-side component, for example a traditional web application.admin-link-provider-for-userLinks an existing user account in a user pool, or DestinationUser, to an identity from an external IdP, or SourceUser, based on a specified attribute name and value from the external IdP.admin-list-devicesLists a user's registered devices.admin-list-groups-for-userLists the groups that a user belongs to.admin-list-user-auth-eventsRequests a history of user activity and any risks detected as part of Amazon Cognito threat protection.admin-remove-user-from-groupGiven a username and a group name, removes them from the group.admin-reset-user-passwordBegins the password reset process.admin-respond-to-auth-challengeSome API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge.admin-set-user-mfa-preferenceSets the user's multi-factor authentication (MFA) preference, including which MFA options are activated, and if any are preferred.admin-set-user-passwordSets the specified user's password in a user pool.admin-set-user-settingsThis action is no longer supported.admin-update-auth-event-feedbackProvides the feedback for an authentication event generated by threat protection features.admin-update-device-statusUpdates the status of a user's device so that it is marked as remembered or not remembered for the purpose of device authentication.admin-update-user-attributesUpdates the specified user's attributes.admin-user-global-sign-outInvalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user.associate-software-tokenBegins setup of time-based one-time password (TOTP) multi-factor authentication (MFA) for a user, with a unique private key that Amazon Cognito generates and returns in the API response.change-passwordChanges the password for the currently signed-in user.complete-web-authn-registrationCompletes registration of a passkey authenticator for the currently signed-in user.confirm-deviceConfirms a device that a user wants to remember.confirm-forgot-passwordThis public API operation accepts a confirmation code that Amazon Cognito sent to a user and accepts a new password for that user.confirm-sign-upConfirms the account of a new user.create-groupCreates a new group in the specified user pool.create-identity-providerAdds a configuration and trust relationship between a third-party identity provider (IdP) and a user pool.create-managed-login-brandingCreates a new set of branding settings for a user pool style and associates it with an app client.create-resource-serverCreates a new OAuth2.0 resource server and defines custom scopes within it.create-termsCreates terms documents for the requested app client.create-user-import-jobCreates a user import job.create-user-poolCreates a new Amazon Cognito user pool.create-user-pool-clientCreates an app client in a user pool.create-user-pool-domainA user pool domain hosts managed login, an authorization server and web server for authentication in your application.create-user-pool-replicaCreates a replica of an existing user pool in a specified Amazon Web Services Region.delete-groupDeletes a group from the specified user pool.delete-identity-providerDeletes a user pool identity provider (IdP).delete-managed-login-brandingDeletes a managed login branding style.delete-resource-serverDeletes a resource server.delete-termsDeletes the terms documents with the requested ID from your app client.delete-userDeletes the profile of the currently signed-in user.delete-user-attributesDeletes attributes from the currently signed-in user.delete-user-poolDeletes a user pool.delete-user-pool-clientDeletes a user pool app client.delete-user-pool-client-secretDeletes a specific client secret from a user pool app client.delete-user-pool-domainGiven a user pool ID and domain identifier, deletes a user pool domain.delete-user-pool-replicaDeletes a secondary replica user pool.delete-web-authn-credentialDeletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.describe-identity-providerGiven a user pool ID and identity provider (IdP) name, returns details about the IdP.describe-managed-login-brandingGiven the ID of a managed login branding style, returns detailed information about the style.describe-managed-login-branding-by-clientGiven the ID of a user pool app client, returns detailed information about the style assigned to the app client.describe-resource-serverDescribes a resource server.describe-risk-configurationGiven an app client or user pool ID where threat protection is configured, describes the risk configuration.describe-termsReturns details for the requested terms documents ID.describe-terms-by-clientReturns details for the terms documents that are associated with an app client, identified by the app client ID, user pool ID, and terms name.describe-user-import-jobDescribes a user import job.describe-user-poolGiven a user pool ID, returns configuration information.describe-user-pool-clientGiven an app client ID, returns configuration information.describe-user-pool-domainGiven a user pool domain name, returns information about the domain configuration.forget-deviceGiven a device key, deletes a remembered device as the currently signed-in user.forgot-passwordSends a password-reset confirmation code to the email address or phone number of the requested username.get-client-tokenIssues an access token for machine-to-machine (M2M) authorization.get-csv-headerGiven a user pool ID, generates a comma-separated value (CSV) list populated with available user attributes in the user pool.get-deviceGiven a device key, returns information about a remembered device for the current user.get-groupGiven a user pool ID and a group name, returns information about the user group.get-identity-provider-by-identifierGiven the identifier of an identity provider (IdP), for example examplecorp, returns information about the user pool configuration for that IdP.get-log-delivery-configurationGiven a user pool ID, returns the logging configuration.get-provisioned-limitReturns the current provisioned limit for a specific API category.get-signing-certificateGiven a user pool ID, returns the signing certificate for SAML 2.0 federation.get-tokens-from-refresh-tokenGiven a refresh token, issues new ID, access, and optionally refresh tokens for the user who owns the submitted token.get-ui-customizationGiven a user pool ID or app client, returns information about classic hosted UI branding that you applied, if any.get-userGets user attributes and and MFA settings for the currently signed-in user.get-user-attribute-verification-codeGiven an attribute name, sends a user attribute verification code for the specified attribute name to the currently signed-in user.get-user-auth-factorsLists the authentication options for the currently signed-in user.get-user-pool-mfa-configGiven a user pool ID, returns configuration for sign-in with WebAuthn authenticators and for multi-factor authentication (MFA).global-sign-outInvalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user.initiate-authDeclares an authentication flow and initiates sign-in for a user in the Amazon Cognito user directory.list-devicesLists the devices that Amazon Cognito has registered to the currently signed-in user.list-groupsGiven a user pool ID, returns user pool groups and their details.list-identity-providersGiven a user pool ID, returns information about configured identity providers (IdPs).list-resource-serversGiven a user pool ID, returns all resource servers and their details.list-tags-for-resourceLists the tags that are assigned to an Amazon Cognito user pool.list-termsReturns details about all terms documents for the requested user pool.list-user-import-jobsGiven a user pool ID, returns user import jobs and their details.list-user-pool-client-secretsLists all client secrets associated with a user pool app client.list-user-pool-clientsGiven a user pool ID, lists app clients.list-user-pool-replicasLists all replicas for a user pool, including both primary and secondary replicas.list-user-poolsLists user pools and their details in the current Amazon Web Services account.list-usersGiven a user pool ID, returns a list of users and their basic details in a user pool.list-users-in-groupGiven a user pool ID and a group name, returns a list of users in the group.list-web-authn-credentialsGenerates a list of the currently signed-in user's registered passkey, or WebAuthn, credentials.resend-confirmation-codeResends the code that confirms a new account for a user who has signed up in your user pool.respond-to-auth-challengeSome API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge.revoke-tokenRevokes all of the access tokens generated by, and at the same time as, the specified refresh token.set-log-delivery-configurationSets up or modifies the logging configuration of a user pool.set-risk-configurationConfigures threat protection for a user pool or app client.set-ui-customizationConfigures UI branding settings for domains with the hosted UI (classic) branding version.set-user-mfa-preferenceSet the user's multi-factor authentication (MFA) method preference, including which MFA factors are activated and if any are preferred.set-user-pool-mfa-configSets user pool multi-factor authentication (MFA) and passkey configuration.set-user-settingsThis action is no longer supported.sign-upRegisters a user with an app client and requests a user name, password, and user attributes in the user pool.start-user-import-jobInstructs your user pool to start importing users from a CSV file that contains their usernames and attributes.start-web-authn-registrationRequests credential creation options from your user pool for the currently signed-in user.stop-user-import-jobInstructs your user pool to stop a running job that's importing users from a CSV file that contains their usernames and attributes.tag-resourceAssigns a set of tags to an Amazon Cognito user pool.untag-resourceGiven tag IDs that you previously assigned to a user pool, removes them.update-auth-event-feedbackProvides the feedback for an authentication event generated by threat protection features.update-device-statusUpdates the status of a the currently signed-in user's device so that it is marked as remembered or not remembered for the purpose of device authentication.update-groupGiven the name of a user pool group, updates any of the properties for precedence, IAM role, or description.update-identity-providerModifies the configuration and trust relationship between a third-party identity provider (IdP) and a user pool.update-managed-login-brandingConfigures the branding settings for a user pool style.update-provisioned-limitSets the provisioned limit for a specific API category.update-resource-serverUpdates the name and scopes of a resource server.update-termsModifies existing terms documents for the requested app client.update-user-attributesUpdates the currently signed-in user's attributes.update-user-poolUpdates the configuration of a user pool.update-user-pool-clientGiven a user pool app client ID, updates the configuration.update-user-pool-domainA user pool domain hosts managed login, an authorization server and web server for authentication in your application.update-user-pool-replicaUpdates replica-specific settings for a user pool replica.verify-software-tokenRegisters the current user's time-based one-time password (TOTP) authenticator with a code generated in their authenticator app from a private key that's supplied by your user pool.verify-user-attributeSubmits a verification code for a signed-in user who has added or changed a value of an auto-verified attribute.