CognitoIdentityProvider class

With the Amazon Cognito user pools API, you can configure user pools and authenticate users. To authenticate users from third-party identity providers (IdPs) in this API, you can link IdP users to native user profiles. Learn more about the authentication and authorization of federated users at Adding user pool sign-in through a third party and in the User pool federation endpoints and managed login reference.

This API reference provides detailed information about API operations and object types in Amazon Cognito.

Along with resource management operations, the Amazon Cognito user pools API includes classes of operations and authorization models for client-side and server-side authentication of users. You can interact with operations in the Amazon Cognito user pools API as any of the following subjects.

  1. An administrator who wants to configure user pools, app clients, users, groups, or other user pool functions.
  2. A server-side app, like a web application, that wants to use its Amazon Web Services privileges to manage, authenticate, or authorize a user.
  3. A client-side app, like a mobile app, that wants to make unauthenticated requests to manage, authenticate, or authorize a user.
For more information, see Understanding API, OIDC, and managed login pages authentication in the Amazon Cognito Developer Guide.

With your Amazon Web Services SDK, you can build the logic to support operational flows in every use case for this API. You can also make direct REST API requests to Amazon Cognito user pools service endpoints. The following links can get you started with the CognitoIdentityProvider client in supported Amazon Web Services SDKs.

To get started with an Amazon Web Services SDK, see Tools to Build on Amazon Web Services. For example actions and scenarios, see Code examples for Amazon Cognito Identity Provider using Amazon Web Services SDKs.

Constructors

CognitoIdentityProvider({required String region, AwsClientCredentials? credentials, AwsClientCredentialsProvider? credentialsProvider, Client? client, String? endpointUrl, bool useFipsEndpoint = false, bool useDualStackEndpoint = false})
factory

Properties

hashCode → int
The hash code for this object.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

addCustomAttributes({required List<SchemaAttributeType> customAttributes, required String userPoolId}) → Future<void>
Adds additional user attributes to the user pool schema. Custom attributes can be mutable or immutable and have a custom: or dev: prefix. For more information, see Custom attributes.
addUserPoolClientSecret({required String clientId, required String userPoolId, String? clientSecret}) → Future<AddUserPoolClientSecretResponse>
Creates a new client secret for an existing confidential user pool app client. Supports up to 2 active secrets per app client for zero-downtime credential rotation workflows.
adminAddUserToGroup({required String groupName, required String userPoolId, required String username}) → Future<void>
Adds a user to a group. A user who is in a group can present a preferred-role claim to an identity pool, and populates a cognito:groups claim to their access and identity tokens.
adminConfirmSignUp({required String userPoolId, required String username, Map<String, String>? clientMetadata}) → Future<void>
Confirms user sign-up as an administrator.
adminCreateUser({required String userPoolId, required String username, Map<String, String>? clientMetadata, List<DeliveryMediumType>? desiredDeliveryMediums, bool? forceAliasCreation, MessageActionType? messageAction, String? temporaryPassword, List<AttributeType>? userAttributes, List<AttributeType>? validationData}) → Future<AdminCreateUserResponse>
Creates a new user in the specified user pool.
adminDeleteUser({required String userPoolId, required String username}) → Future<void>
Deletes a user profile in your user pool.
adminDeleteUserAttributes({required List<String> userAttributeNames, required String userPoolId, required String username}) → Future<void>
Deletes attribute values from a user. This operation doesn't affect tokens for existing user sessions. The next ID token that the user receives will no longer have the deleted attributes.
adminDisableProviderForUser({required ProviderUserIdentifierType user, required String userPoolId}) → Future<void>
Prevents the user from signing in with the specified external (SAML or social) identity provider (IdP). If the user that you want to deactivate is a Amazon Cognito user pools native username + password user, they can't use their password to sign in. If the user to deactivate is a linked external IdP user, any link between that user and an existing user is removed. When the external user signs in again, and the user is no longer attached to the previously linked DestinationUser, the user must create a new user account.
adminDisableUser({required String userPoolId, required String username}) → Future<void>
Deactivates a user profile and revokes all access tokens for the user. A deactivated user can't sign in, but still appears in the responses to ListUsers API requests.
adminEnableUser({required String userPoolId, required String username}) → Future<void>
Activates sign-in for a user profile that previously had sign-in access disabled.
adminForgetDevice({required String deviceKey, required String userPoolId, required String username}) → Future<void>
Forgets, or deletes, a remembered device from a user's profile. After you forget the device, the user can no longer complete device authentication with that device and when applicable, must submit MFA codes again. For more information, see Working with devices.
adminGetDevice({required String deviceKey, required String userPoolId, required String username}) → Future<AdminGetDeviceResponse>
Given the device key, returns details for a user's device. For more information, see Working with devices.
adminGetUser({required String userPoolId, required String username}) → Future<AdminGetUserResponse>
Given a username, returns details about a user profile in a user pool. You can specify alias attributes in the Username request parameter.
adminGetUserAuthFactors({required String userPoolId, required String username}) → Future<AdminGetUserAuthFactorsResponse>
Lists the authentication options for a user in a user pool. Returns the following:
adminInitiateAuth({required AuthFlowType authFlow, required String clientId, required String userPoolId, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? authParameters, Map<String, String>? clientMetadata, ContextDataType? contextData, String? session}) → Future<AdminInitiateAuthResponse>
Starts sign-in for applications with a server-side component, for example a traditional web application. This operation specifies the authentication flow that you'd like to begin. The authentication flow that you specify must be supported in your app client configuration. For more information about authentication flows, see Authentication flows.
adminLinkProviderForUser({required ProviderUserIdentifierType destinationUser, required ProviderUserIdentifierType sourceUser, required String userPoolId}) → Future<void>
Links an existing user account in a user pool, or DestinationUser, to an identity from an external IdP, or SourceUser, based on a specified attribute name and value from the external IdP.
adminListDevices({required String userPoolId, required String username, int? limit, String? paginationToken}) → Future<AdminListDevicesResponse>
Lists a user's registered devices. Remembered devices are used in authentication services where you offer a "Remember me" option for users who you want to permit to sign in without MFA from a trusted device. Users can bypass MFA while your application performs device SRP authentication on the back end. For more information, see Working with devices.
adminListGroupsForUser({required String userPoolId, required String username, int? limit, String? nextToken}) → Future<AdminListGroupsForUserResponse>
Lists the groups that a user belongs to. User pool groups are identifiers that you can reference from the contents of ID and access tokens, and set preferred IAM roles for identity-pool authentication. For more information, see Adding groups to a user pool.
adminListUserAuthEvents({required String userPoolId, required String username, int? maxResults, String? nextToken}) → Future<AdminListUserAuthEventsResponse>
Requests a history of user activity and any risks detected as part of Amazon Cognito threat protection. For more information, see Viewing user event history.
adminRemoveUserFromGroup({required String groupName, required String userPoolId, required String username}) → Future<void>
Given a username and a group name, removes them from the group. User pool groups are identifiers that you can reference from the contents of ID and access tokens, and set preferred IAM roles for identity-pool authentication. For more information, see Adding groups to a user pool.
adminResetUserPassword({required String userPoolId, required String username, Map<String, String>? clientMetadata}) → Future<void>
Begins the password reset process. Sets the requested user’s account into a RESET_REQUIRED status, and sends them a password-reset code. Your user pool also sends the user a notification with a reset code and the information that their password has been reset. At sign-in, your application or the managed login session receives a challenge to complete the reset by confirming the code and setting a new password.
adminRespondToAuthChallenge({required ChallengeNameType challengeName, required String clientId, required String userPoolId, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? challengeResponses, Map<String, String>? clientMetadata, ContextDataType? contextData, String? session}) → Future<AdminRespondToAuthChallengeResponse>
Some API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge. An AdminRespondToAuthChallenge API request provides the answer to that challenge, like a code or a secure remote password (SRP). The parameters of a response to an authentication challenge vary with the type of challenge.
adminSetUserMFAPreference({required String userPoolId, required String username, EmailMfaSettingsType? emailMfaSettings, SMSMfaSettingsType? sMSMfaSettings, SoftwareTokenMfaSettingsType? softwareTokenMfaSettings, WebAuthnMfaSettingsType? webAuthnMfaSettings}) → Future<void>
Sets the user's multi-factor authentication (MFA) preference, including which MFA options are activated, and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in.
adminSetUserPassword({required String password, required String userPoolId, required String username, bool? permanent}) → Future<void>
Sets the specified user's password in a user pool. This operation administratively sets a temporary or permanent password for a user. With this operation, you can bypass self-service password changes and permit immediate sign-in with the password that you set. To do this, set Permanent to true.
adminSetUserSettings({required List<MFAOptionType> mFAOptions, required String userPoolId, required String username}) → Future<void>
This action is no longer supported. You can use it to configure only SMS MFA. You can't use it to configure time-based one-time password (TOTP) software token MFA.
adminUpdateAuthEventFeedback({required String eventId, required FeedbackValueType feedbackValue, required String userPoolId, required String username}) → Future<void>
Provides the feedback for an authentication event generated by threat protection features. Your response indicates that you think that the event either was from a valid user or was an unwanted authentication attempt. This feedback improves the risk evaluation decision for the user pool as part of Amazon Cognito threat protection. To activate this setting, your user pool must be on the Plus tier.
adminUpdateDeviceStatus({required String deviceKey, required String userPoolId, required String username, DeviceRememberedStatusType? deviceRememberedStatus}) → Future<void>
Updates the status of a user's device so that it is marked as remembered or not remembered for the purpose of device authentication. Device authentication is a "remember me" mechanism that silently completes sign-in from trusted devices with a device key instead of a user-provided MFA code. This operation changes the status of a device without deleting it, so you can enable it again later. For more information about device authentication, see Working with devices.
adminUpdateUserAttributes({required List<AttributeType> userAttributes, required String userPoolId, required String username, Map<String, String>? clientMetadata}) → Future<void>
Updates the specified user's attributes. To delete an attribute from your user, submit the attribute in your API request with a blank value.
adminUserGlobalSignOut({required String userPoolId, required String username}) → Future<void>
Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation with your administrative credentials when your user signs out of your app. This results in the following behavior.
associateSoftwareToken({String? accessToken, String? session}) → Future<AssociateSoftwareTokenResponse>
Begins setup of time-based one-time password (TOTP) multi-factor authentication (MFA) for a user, with a unique private key that Amazon Cognito generates and returns in the API response. You can authorize an AssociateSoftwareToken request with either the user's access token, or a session string from a challenge response that you received from Amazon Cognito. Authorize this action with a signed-in user's access token. It must include the scope aws.cognito.signin.user.admin.
changePassword({required String accessToken, required String proposedPassword, String? previousPassword}) → Future<void>
Changes the password for the currently signed-in user.
close() → void
Closes the internal HTTP client if none was provided at creation. If a client was passed as a constructor argument, this becomes a noop.
completeWebAuthnRegistration({required String accessToken, required Object credential}) → Future<void>
Completes registration of a passkey authenticator for the currently signed-in user.
confirmDevice({required String accessToken, required String deviceKey, String? deviceName, DeviceSecretVerifierConfigType? deviceSecretVerifierConfig}) → Future<ConfirmDeviceResponse>
Confirms a device that a user wants to remember. A remembered device is a "Remember me on this device" option for user pools that perform authentication with the device key of a trusted device in the back end, instead of a user-provided MFA code. For more information about device authentication, see Working with user devices in your user pool.
confirmForgotPassword({required String clientId, required String confirmationCode, required String password, required String username, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? clientMetadata, String? secretHash, UserContextDataType? userContextData}) → Future<void>
This public API operation accepts a confirmation code that Amazon Cognito sent to a user and accepts a new password for that user.
confirmSignUp({required String clientId, required String confirmationCode, required String username, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? clientMetadata, bool? forceAliasCreation, String? secretHash, String? session, UserContextDataType? userContextData}) → Future<ConfirmSignUpResponse>
Confirms the account of a new user. This public API operation submits a code that Amazon Cognito sent to your user when they signed up in your user pool. After your user enters their code, they confirm ownership of the email address or phone number that they provided, and their user account becomes active. Depending on your user pool configuration, your users will receive their confirmation code in an email or SMS message.
createGroup({required String groupName, required String userPoolId, String? description, int? precedence, String? roleArn}) → Future<CreateGroupResponse>
Creates a new group in the specified user pool. For more information about user pool groups, see Adding groups to a user pool.
createIdentityProvider({required Map<String, String> providerDetails, required String providerName, required IdentityProviderTypeType providerType, required String userPoolId, Map<String, String>? attributeMapping, List<String>? idpIdentifiers}) → Future<CreateIdentityProviderResponse>
Adds a configuration and trust relationship between a third-party identity provider (IdP) and a user pool. Amazon Cognito accepts sign-in with third-party identity providers through managed login and OIDC relying-party libraries. For more information, see Third-party IdP sign-in.
createManagedLoginBranding({required String clientId, required String userPoolId, List<AssetType>? assets, Object? settings, bool? useCognitoProvidedValues}) → Future<CreateManagedLoginBrandingResponse>
Creates a new set of branding settings for a user pool style and associates it with an app client. This operation is the programmatic option for the creation of a new style in the branding editor.
createResourceServer({required String identifier, required String name, required String userPoolId, List<ResourceServerScopeType>? scopes}) → Future<CreateResourceServerResponse>
Creates a new OAuth2.0 resource server and defines custom scopes within it. Resource servers are associated with custom scopes and machine-to-machine (M2M) authorization. For more information, see Access control with resource servers.
createTerms({required String clientId, required TermsEnforcementType enforcement, required String termsName, required TermsSourceType termsSource, required String userPoolId, Map<String, String>? links}) → Future<CreateTermsResponse>
Creates terms documents for the requested app client. When Terms and conditions and Privacy policy documents are configured, the app client displays links to them in the sign-up page of managed login for the app client.
createUserImportJob({required String cloudWatchLogsRoleArn, required String jobName, required String userPoolId, PasswordHashingAlgorithmType? passwordHashingAlgorithm}) → Future<CreateUserImportJobResponse>
Creates a user import job. You can import users into user pools from a comma-separated values (CSV) file without adding Amazon Cognito MAU costs to your Amazon Web Services bill.
createUserPool({required String poolName, AccountRecoverySettingType? accountRecoverySetting, AdminCreateUserConfigType? adminCreateUserConfig, List<AliasAttributeType>? aliasAttributes, List<VerifiedAttributeType>? autoVerifiedAttributes, DeletionProtectionType? deletionProtection, DeviceConfigurationType? deviceConfiguration, EmailConfigurationType? emailConfiguration, String? emailVerificationMessage, String? emailVerificationSubject, IssuerConfigurationType? issuerConfiguration, KeyConfigurationType? keyConfiguration, LambdaConfigType? lambdaConfig, UserPoolMfaType? mfaConfiguration, UserPoolPolicyType? policies, List<SchemaAttributeType>? schema, String? smsAuthenticationMessage, SmsConfigurationType? smsConfiguration, String? smsVerificationMessage, UserAttributeUpdateSettingsType? userAttributeUpdateSettings, UserPoolAddOnsType? userPoolAddOns, Map<String, String>? userPoolTags, UserPoolTierType? userPoolTier, List<UsernameAttributeType>? usernameAttributes, UsernameConfigurationType? usernameConfiguration, VerificationMessageTemplateType? verificationMessageTemplate}) → Future<CreateUserPoolResponse>
Creates a new Amazon Cognito user pool. This operation sets basic and advanced configuration options.
createUserPoolClient({required String clientName, required String userPoolId, int? accessTokenValidity, List<OAuthFlowType>? allowedOAuthFlows, bool? allowedOAuthFlowsUserPoolClient, List<String>? allowedOAuthScopes, AnalyticsConfigurationType? analyticsConfiguration, int? authSessionValidity, List<String>? callbackURLs, String? clientSecret, String? defaultRedirectURI, bool? enablePropagateAdditionalUserContextData, bool? enableTokenRevocation, List<ExplicitAuthFlowsType>? explicitAuthFlows, bool? generateSecret, int? idTokenValidity, List<String>? logoutURLs, PreventUserExistenceErrorTypes? preventUserExistenceErrors, List<String>? readAttributes, RefreshTokenRotationType? refreshTokenRotation, int? refreshTokenValidity, List<String>? supportedIdentityProviders, TokenValidityUnitsType? tokenValidityUnits, List<String>? writeAttributes}) → Future<CreateUserPoolClientResponse>
Creates an app client in a user pool. This operation sets basic and advanced configuration options.
createUserPoolDomain({required String domain, required String userPoolId, CustomDomainConfigType? customDomainConfig, int? managedLoginVersion, RoutingType? routing}) → Future<CreateUserPoolDomainResponse>
A user pool domain hosts managed login, an authorization server and web server for authentication in your application. This operation creates a new user pool prefix domain or custom domain and sets the managed login branding version. Set the branding version to 1 for hosted UI (classic) or 2 for managed login. When you choose a custom domain, you must provide an SSL certificate in the US East (N. Virginia) Amazon Web Services Region in your request.
createUserPoolReplica({required String regionName, required String userPoolId, Map<String, String>? userPoolTags}) → Future<CreateUserPoolReplicaResponse>
Creates a replica of an existing user pool in a specified Amazon Web Services Region. The replica enables multi-region replication for high availability and disaster recovery. To create a replica, you must have permissions to create user pools in the target Region.
deleteGroup({required String groupName, required String userPoolId}) → Future<void>
Deletes a group from the specified user pool. When you delete a group, that group no longer contributes to users' cognito:preferred_group or cognito:groups claims, and no longer influence access-control decision that are based on group membership. For more information about user pool groups, see Adding groups to a user pool.
deleteIdentityProvider({required String providerName, required String userPoolId}) → Future<void>
Deletes a user pool identity provider (IdP). After you delete an IdP, users can no longer sign in to your user pool through that IdP. For more information about user pool IdPs, see Third-party IdP sign-in.
deleteManagedLoginBranding({required String managedLoginBrandingId, required String userPoolId}) → Future<void>
Deletes a managed login branding style. When you delete a style, you delete the branding association for an app client. When an app client doesn't have a style assigned, your managed login pages for that app client are nonfunctional until you create a new style or switch the domain branding version.
deleteResourceServer({required String identifier, required String userPoolId}) → Future<void>
Deletes a resource server. After you delete a resource server, users can no longer generate access tokens with scopes that are associate with that resource server.
deleteTerms({required String termsId, required String userPoolId}) → Future<void>
Deletes the terms documents with the requested ID from your app client.
deleteUser({required String accessToken}) → Future<void>
Deletes the profile of the currently signed-in user. A deleted user profile can no longer be used to sign in and can't be restored.
deleteUserAttributes({required String accessToken, required List<String> userAttributeNames}) → Future<void>
Deletes attributes from the currently signed-in user. For example, your application can submit a request to this operation when a user wants to remove their birthdate attribute value.
deleteUserPool({required String userPoolId}) → Future<void>
Deletes a user pool. After you delete a user pool, users can no longer sign in to any associated applications.
deleteUserPoolClient({required String clientId, required String userPoolId}) → Future<void>
Deletes a user pool app client. After you delete an app client, users can no longer sign in to the associated application.
deleteUserPoolClientSecret({required String clientId, required String clientSecretId, required String userPoolId}) → Future<void>
Deletes a specific client secret from a user pool app client. You cannot delete the last remaining secret for an app client.
deleteUserPoolDomain({required String domain, required String userPoolId}) → Future<void>
Given a user pool ID and domain identifier, deletes a user pool domain. After you delete a user pool domain, your managed login pages and authorization server are no longer available.
deleteUserPoolReplica({required String regionName, required String userPoolId}) → Future<DeleteUserPoolReplicaResponse>
Deletes a secondary replica user pool. You can only delete replicas that are in the INACTIVE status. This operation must be called from the primary Region.
deleteWebAuthnCredential({required String accessToken, required String credentialId}) → Future<void>
Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
describeIdentityProvider({required String providerName, required String userPoolId}) → Future<DescribeIdentityProviderResponse>
Given a user pool ID and identity provider (IdP) name, returns details about the IdP.
describeManagedLoginBranding({required String managedLoginBrandingId, required String userPoolId, bool? returnMergedResources}) → Future<DescribeManagedLoginBrandingResponse>
Given the ID of a managed login branding style, returns detailed information about the style.
describeManagedLoginBrandingByClient({required String clientId, required String userPoolId, bool? returnMergedResources}) → Future<DescribeManagedLoginBrandingByClientResponse>
Given the ID of a user pool app client, returns detailed information about the style assigned to the app client.
describeResourceServer({required String identifier, required String userPoolId}) → Future<DescribeResourceServerResponse>
Describes a resource server. For more information about resource servers, see Access control with resource servers.
describeRiskConfiguration({required String userPoolId, String? clientId}) → Future<DescribeRiskConfigurationResponse>
Given an app client or user pool ID where threat protection is configured, describes the risk configuration. This operation returns details about adaptive authentication, compromised credentials, and IP-address allow- and denylists. For more information about threat protection, see Threat protection.
describeTerms({required String termsId, required String userPoolId}) → Future<DescribeTermsResponse>
Returns details for the requested terms documents ID. For more information, see Terms documents.
describeUserImportJob({required String jobId, required String userPoolId}) → Future<DescribeUserImportJobResponse>
Describes a user import job. For more information about user CSV import, see Importing users from a CSV file.
describeUserPool({required String userPoolId}) → Future<DescribeUserPoolResponse>
Given a user pool ID, returns configuration information. This operation is useful when you want to inspect an existing user pool and programmatically replicate the configuration to another user pool.
describeUserPoolClient({required String clientId, required String userPoolId}) → Future<DescribeUserPoolClientResponse>
Given an app client ID, returns configuration information. This operation is useful when you want to inspect an existing app client and programmatically replicate the configuration to another app client. For more information about app clients, see App clients.
describeUserPoolDomain({required String domain}) → Future<DescribeUserPoolDomainResponse>
Given a user pool domain name, returns information about the domain configuration.
forgetDevice({required String deviceKey, String? accessToken}) → Future<void>
Given a device key, deletes a remembered device as the currently signed-in user. For more information about device authentication, see Working with user devices in your user pool.
forgotPassword({required String clientId, required String username, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? clientMetadata, String? secretHash, UserContextDataType? userContextData}) → Future<ForgotPasswordResponse>
Sends a password-reset confirmation code to the email address or phone number of the requested username. The message delivery method is determined by the user's available attributes and the AccountRecoverySetting configuration of the user pool.
getCSVHeader({required String userPoolId}) → Future<GetCSVHeaderResponse>
Given a user pool ID, generates a comma-separated value (CSV) list populated with available user attributes in the user pool. This list is the header for the CSV file that determines the users in a user import job. Save the content of CSVHeader in the response as a .csv file and populate it with the usernames and attributes of users that you want to import. For more information about CSV user import, see Importing users from a CSV file.
getDevice({required String deviceKey, String? accessToken}) → Future<GetDeviceResponse>
Given a device key, returns information about a remembered device for the current user. For more information about device authentication, see Working with user devices in your user pool.
getGroup({required String groupName, required String userPoolId}) → Future<GetGroupResponse>
Given a user pool ID and a group name, returns information about the user group.
getIdentityProviderByIdentifier({required String idpIdentifier, required String userPoolId}) → Future<GetIdentityProviderByIdentifierResponse>
Given the identifier of an identity provider (IdP), for example examplecorp, returns information about the user pool configuration for that IdP. For more information about IdPs, see Third-party IdP sign-in.
getLogDeliveryConfiguration({required String userPoolId}) → Future<GetLogDeliveryConfigurationResponse>
Given a user pool ID, returns the logging configuration. User pools can export message-delivery error and threat-protection activity logs to external Amazon Web Services services. For more information, see Exporting user pool logs.
getProvisionedLimit({required LimitDefinitionType limitDefinition}) → Future<GetProvisionedLimitResponse>
Returns the current provisioned limit for a specific API category.
getSigningCertificate({required String userPoolId}) → Future<GetSigningCertificateResponse>
Given a user pool ID, returns the signing certificate for SAML 2.0 federation.
getTokensFromRefreshToken({required String clientId, required String refreshToken, Map<String, String>? clientMetadata, String? clientSecret, String? deviceKey}) → Future<GetTokensFromRefreshTokenResponse>
Given a refresh token, issues new ID, access, and optionally refresh tokens for the user who owns the submitted token. This operation issues a new refresh token and invalidates the original refresh token after an optional grace period when refresh token rotation is enabled. If refresh token rotation is disabled, issues new ID and access tokens only.
getUICustomization({required String userPoolId, String? clientId}) → Future<GetUICustomizationResponse>
Given a user pool ID or app client, returns information about classic hosted UI branding that you applied, if any. Returns user-pool level branding information if no app client branding is applied, or if you don't specify an app client ID. Returns an empty object if you haven't applied hosted UI branding to either the client or the user pool. For more information, see Hosted UI (classic) branding.
getUser({required String accessToken}) → Future<GetUserResponse>
Gets user attributes and and MFA settings for the currently signed-in user.
getUserAttributeVerificationCode({required String accessToken, required String attributeName, Map<String, String>? clientMetadata}) → Future<GetUserAttributeVerificationCodeResponse>
Given an attribute name, sends a user attribute verification code for the specified attribute name to the currently signed-in user.
getUserAuthFactors({required String accessToken}) → Future<GetUserAuthFactorsResponse>
Lists the authentication options for the currently signed-in user. Returns the following:
getUserPoolMfaConfig({required String userPoolId}) → Future<GetUserPoolMfaConfigResponse>
Given a user pool ID, returns configuration for sign-in with WebAuthn authenticators and for multi-factor authentication (MFA). This operation describes the following:
globalSignOut({required String accessToken}) → Future<void>
Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call this operation when your user signs out of your app. This results in the following behavior.
initiateAuth({required AuthFlowType authFlow, required String clientId, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? authParameters, Map<String, String>? clientMetadata, String? session, UserContextDataType? userContextData}) → Future<InitiateAuthResponse>
Declares an authentication flow and initiates sign-in for a user in the Amazon Cognito user directory. Amazon Cognito might respond with an additional challenge or an AuthenticationResult that contains the outcome of a successful authentication. You can't sign in a user with a federated IdP with InitiateAuth. For more information, see Authentication.
listDevices({required String accessToken, int? limit, String? paginationToken}) → Future<ListDevicesResponse>
Lists the devices that Amazon Cognito has registered to the currently signed-in user. For more information about device authentication, see Working with user devices in your user pool.
listGroups({required String userPoolId, int? limit, String? nextToken}) → Future<ListGroupsResponse>
Given a user pool ID, returns user pool groups and their details.
listIdentityProviders({required String userPoolId, int? maxResults, String? nextToken}) → Future<ListIdentityProvidersResponse>
Given a user pool ID, returns information about configured identity providers (IdPs). For more information about IdPs, see Third-party IdP sign-in.
listResourceServers({required String userPoolId, int? maxResults, String? nextToken}) → Future<ListResourceServersResponse>
Given a user pool ID, returns all resource servers and their details. For more information about resource servers, see Access control with resource servers.
listTagsForResource({required String resourceArn}) → Future<ListTagsForResourceResponse>
Lists the tags that are assigned to an Amazon Cognito user pool. For more information, see Tagging resources.
listTerms({required String userPoolId, int? maxResults, String? nextToken}) → Future<ListTermsResponse>
Returns details about all terms documents for the requested user pool.
listUserImportJobs({required int maxResults, required String userPoolId, String? paginationToken}) → Future<ListUserImportJobsResponse>
Given a user pool ID, returns user import jobs and their details. Import jobs are retained in user pool configuration so that you can stage, stop, start, review, and delete them. For more information about user import, see Importing users from a CSV file.
listUserPoolClients({required String userPoolId, int? maxResults, String? nextToken}) → Future<ListUserPoolClientsResponse>
Given a user pool ID, lists app clients. App clients are sets of rules for the access that you want a user pool to grant to one application. For more information, see App clients.
listUserPoolClientSecrets({required String clientId, required String userPoolId, String? nextToken}) → Future<ListUserPoolClientSecretsResponse>
Lists all client secrets associated with a user pool app client. Returns metadata about the secrets. The response does not include pagination tokens as there are only 2 secrets at any given time and we return both with every ListUserPoolClientSecrets call. For security reasons, the response never reveals the actual secret value in ClientSecretValue.
listUserPoolReplicas({required String userPoolId, String? nextToken}) → Future<ListUserPoolReplicasResponse>
Lists all replicas for a user pool, including both primary and secondary replicas. We recommend using pagination to ensure that the operation returns quickly and successfully.
listUserPools({required int maxResults, String? nextToken}) → Future<ListUserPoolsResponse>
Lists user pools and their details in the current Amazon Web Services account.
listUsers({required String userPoolId, List<String>? attributesToGet, String? filter, int? limit, String? paginationToken}) → Future<ListUsersResponse>
Given a user pool ID, returns a list of users and their basic details in a user pool.
listUsersInGroup({required String groupName, required String userPoolId, int? limit, String? nextToken}) → Future<ListUsersInGroupResponse>
Given a user pool ID and a group name, returns a list of users in the group. For more information about user pool groups, see Adding groups to a user pool.
listWebAuthnCredentials({required String accessToken, int? maxResults, String? nextToken}) → Future<ListWebAuthnCredentialsResponse>
Generates a list of the currently signed-in user's registered passkey, or WebAuthn, credentials.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
resendConfirmationCode({required String clientId, required String username, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? clientMetadata, String? secretHash, UserContextDataType? userContextData}) → Future<ResendConfirmationCodeResponse>
Resends the code that confirms a new account for a user who has signed up in your user pool. Amazon Cognito sends confirmation codes to the user attribute in the AutoVerifiedAttributes property of your user pool. When you prompt new users for the confirmation code, include a "Resend code" option that generates a call to this API operation.
respondToAuthChallenge({required ChallengeNameType challengeName, required String clientId, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? challengeResponses, Map<String, String>? clientMetadata, String? session, UserContextDataType? userContextData}) → Future<RespondToAuthChallengeResponse>
Some API operations in a user pool generate a challenge, like a prompt for an MFA code, for device authentication that bypasses MFA, or for a custom authentication challenge. A RespondToAuthChallenge API request provides the answer to that challenge, like a code or a secure remote password (SRP). The parameters of a response to an authentication challenge vary with the type of challenge.
revokeToken({required String clientId, required String token, String? clientSecret}) → Future<void>
Revokes all of the access tokens generated by, and at the same time as, the specified refresh token. After a token is revoked, you can't use the revoked token to access Amazon Cognito user APIs, or to authorize access to your resource server.
setLogDeliveryConfiguration({required List<LogConfigurationType> logConfigurations, required String userPoolId}) → Future<SetLogDeliveryConfigurationResponse>
Sets up or modifies the logging configuration of a user pool. User pools can export user notification logs and, when threat protection is active, user-activity logs. For more information, see Exporting user pool logs.
setRiskConfiguration({required String userPoolId, AccountTakeoverRiskConfigurationType? accountTakeoverRiskConfiguration, String? clientId, CompromisedCredentialsRiskConfigurationType? compromisedCredentialsRiskConfiguration, RiskExceptionConfigurationType? riskExceptionConfiguration}) → Future<SetRiskConfigurationResponse>
Configures threat protection for a user pool or app client. Sets configuration for the following.
setUICustomization({required String userPoolId, String? css, String? clientId, Uint8List? imageFile}) → Future<SetUICustomizationResponse>
Configures UI branding settings for domains with the hosted UI (classic) branding version. Your user pool must have a domain. Configure a domain with .
setUserMFAPreference({required String accessToken, EmailMfaSettingsType? emailMfaSettings, SMSMfaSettingsType? sMSMfaSettings, SoftwareTokenMfaSettingsType? softwareTokenMfaSettings, WebAuthnMfaSettingsType? webAuthnMfaSettings}) → Future<void>
Set the user's multi-factor authentication (MFA) method preference, including which MFA factors are activated and if any are preferred. Only one factor can be set as preferred. The preferred MFA factor will be used to authenticate a user if multiple factors are activated. If multiple options are activated and no preference is set, a challenge to choose an MFA option will be returned during sign-in. If an MFA type is activated for a user, the user will be prompted for MFA during all sign-in attempts unless device tracking is turned on and the device has been trusted. If you want MFA to be applied selectively based on the assessed risk level of sign-in attempts, deactivate MFA for users and turn on Adaptive Authentication for the user pool.
setUserPoolMfaConfig({required String userPoolId, EmailMfaConfigType? emailMfaConfiguration, UserPoolMfaType? mfaConfiguration, SmsMfaConfigType? smsMfaConfiguration, SoftwareTokenMfaConfigType? softwareTokenMfaConfiguration, WebAuthnConfigurationType? webAuthnConfiguration}) → Future<SetUserPoolMfaConfigResponse>
Sets user pool multi-factor authentication (MFA) and passkey configuration. For more information about user pool MFA, see Adding MFA. For more information about WebAuthn passkeys see Authentication flows.
setUserSettings({required String accessToken, required List<MFAOptionType> mFAOptions}) → Future<void>
This action is no longer supported. You can use it to configure only SMS MFA. You can't use it to configure time-based one-time password (TOTP) software token or email MFA.
signUp({required String clientId, required String username, AnalyticsMetadataType? analyticsMetadata, Map<String, String>? clientMetadata, String? password, String? secretHash, List<AttributeType>? userAttributes, UserContextDataType? userContextData, List<AttributeType>? validationData}) → Future<SignUpResponse>
Registers a user with an app client and requests a user name, password, and user attributes in the user pool.
startUserImportJob({required String jobId, required String userPoolId}) → Future<StartUserImportJobResponse>
Instructs your user pool to start importing users from a CSV file that contains their usernames and attributes. For more information about importing users from a CSV file, see Importing users from a CSV file.
startWebAuthnRegistration({required String accessToken}) → Future<StartWebAuthnRegistrationResponse>
Requests credential creation options from your user pool for the currently signed-in user. Returns information about the user pool, the user profile, and authentication requirements. Users must provide this information in their request to enroll your application with their passkey provider.
stopUserImportJob({required String jobId, required String userPoolId}) → Future<StopUserImportJobResponse>
Instructs your user pool to stop a running job that's importing users from a CSV file that contains their usernames and attributes. For more information about importing users from a CSV file, see Importing users from a CSV file.
tagResource({required String resourceArn, required Map<String, String> tags}) → Future<void>
Assigns a set of tags to an Amazon Cognito user pool. A tag is a label that you can use to categorize and manage user pools in different ways, such as by purpose, owner, environment, or other criteria.
toString() → String
A string representation of this object.
inherited
untagResource({required String resourceArn, required List<String> tagKeys}) → Future<void>
Given tag IDs that you previously assigned to a user pool, removes them.
updateAuthEventFeedback({required String eventId, required String feedbackToken, required FeedbackValueType feedbackValue, required String userPoolId, required String username}) → Future<void>
Provides the feedback for an authentication event generated by threat protection features. The user's response indicates that you think that the event either was from a valid user or was an unwanted authentication attempt. This feedback improves the risk evaluation decision for the user pool as part of Amazon Cognito threat protection. To activate this setting, your user pool must be on the Plus tier.
updateDeviceStatus({required String accessToken, required String deviceKey, DeviceRememberedStatusType? deviceRememberedStatus}) → Future<void>
Updates the status of a the currently signed-in user's device so that it is marked as remembered or not remembered for the purpose of device authentication. Device authentication is a "remember me" mechanism that silently completes sign-in from trusted devices with a device key instead of a user-provided MFA code. This operation changes the status of a device without deleting it, so you can enable it again later. For more information about device authentication, see Working with devices.
updateGroup({required String groupName, required String userPoolId, String? description, int? precedence, String? roleArn}) → Future<UpdateGroupResponse>
Given the name of a user pool group, updates any of the properties for precedence, IAM role, or description. For more information about user pool groups, see Adding groups to a user pool.
updateIdentityProvider({required String providerName, required String userPoolId, Map<String, String>? attributeMapping, List<String>? idpIdentifiers, Map<String, String>? providerDetails}) → Future<UpdateIdentityProviderResponse>
Modifies the configuration and trust relationship between a third-party identity provider (IdP) and a user pool. Amazon Cognito accepts sign-in with third-party identity providers through managed login and OIDC relying-party libraries. For more information, see Third-party IdP sign-in.
updateManagedLoginBranding({List<AssetType>? assets, String? managedLoginBrandingId, Object? settings, bool? useCognitoProvidedValues, String? userPoolId}) → Future<UpdateManagedLoginBrandingResponse>
Configures the branding settings for a user pool style. This operation is the programmatic option for the configuration of a style in the branding editor.
updateProvisionedLimit({required LimitDefinitionType limitDefinition, required int requestedLimitValue}) → Future<UpdateProvisionedLimitResponse>
Sets the provisioned limit for a specific API category. The value must be between the default limit and your account-level maximum limit in Service Quotas.
updateResourceServer({required String identifier, required String name, required String userPoolId, List<ResourceServerScopeType>? scopes}) → Future<UpdateResourceServerResponse>
Updates the name and scopes of a resource server. All other fields are read-only. For more information about resource servers, see Access control with resource servers.
updateTerms({required String termsId, required String userPoolId, TermsEnforcementType? enforcement, Map<String, String>? links, String? termsName, TermsSourceType? termsSource}) → Future<UpdateTermsResponse>
Modifies existing terms documents for the requested app client. When Terms and conditions and Privacy policy documents are configured, the app client displays links to them in the sign-up page of managed login for the app client.
updateUserAttributes({required String accessToken, required List<AttributeType> userAttributes, Map<String, String>? clientMetadata}) → Future<UpdateUserAttributesResponse>
Updates the currently signed-in user's attributes. To delete an attribute from the user, submit the attribute in your API request with a blank value.
updateUserPool({required String userPoolId, AccountRecoverySettingType? accountRecoverySetting, AdminCreateUserConfigType? adminCreateUserConfig, List<VerifiedAttributeType>? autoVerifiedAttributes, DeletionProtectionType? deletionProtection, DeviceConfigurationType? deviceConfiguration, EmailConfigurationType? emailConfiguration, String? emailVerificationMessage, String? emailVerificationSubject, IssuerConfigurationType? issuerConfiguration, KeyConfigurationType? keyConfiguration, LambdaConfigType? lambdaConfig, UserPoolMfaType? mfaConfiguration, UserPoolPolicyType? policies, String? poolName, String? smsAuthenticationMessage, SmsConfigurationType? smsConfiguration, String? smsVerificationMessage, UserAttributeUpdateSettingsType? userAttributeUpdateSettings, UserPoolAddOnsType? userPoolAddOns, Map<String, String>? userPoolTags, UserPoolTierType? userPoolTier, VerificationMessageTemplateType? verificationMessageTemplate}) → Future<void>
Updates the configuration of a user pool. To avoid setting parameters to Amazon Cognito defaults, construct this API request to pass the existing configuration of your user pool, modified to include the changes that you want to make. In secondary regions for user pools with multi-region replication, regional configurations for email, SMS, Lambda functions, and tags can be updated. Both global and regional settings must be provided as inputs, with global settings required to match existing values to maintain consistency across replicas.
updateUserPoolClient({required String clientId, required String userPoolId, int? accessTokenValidity, List<OAuthFlowType>? allowedOAuthFlows, bool? allowedOAuthFlowsUserPoolClient, List<String>? allowedOAuthScopes, AnalyticsConfigurationType? analyticsConfiguration, int? authSessionValidity, List<String>? callbackURLs, String? clientName, String? defaultRedirectURI, bool? enablePropagateAdditionalUserContextData, bool? enableTokenRevocation, List<ExplicitAuthFlowsType>? explicitAuthFlows, int? idTokenValidity, List<String>? logoutURLs, PreventUserExistenceErrorTypes? preventUserExistenceErrors, List<String>? readAttributes, RefreshTokenRotationType? refreshTokenRotation, int? refreshTokenValidity, List<String>? supportedIdentityProviders, TokenValidityUnitsType? tokenValidityUnits, List<String>? writeAttributes}) → Future<UpdateUserPoolClientResponse>
Given a user pool app client ID, updates the configuration. To avoid setting parameters to Amazon Cognito defaults, construct this API request to pass the existing configuration of your app client, modified to include the changes that you want to make. Unlike app clients created in the console, Amazon Cognito doesn't automatically assign a branding style to app clients that you configure with this API operation. Managed login and classic hosted UI pages aren't available for your client until after you apply a branding style.
updateUserPoolDomain({required String domain, required String userPoolId, CustomDomainConfigType? customDomainConfig, int? managedLoginVersion, RoutingType? routing}) → Future<UpdateUserPoolDomainResponse>
A user pool domain hosts managed login, an authorization server and web server for authentication in your application. This operation updates the branding version for user pool domains between 1 for hosted UI (classic) and 2 for managed login. It also updates the SSL certificate for user pool custom domains.
updateUserPoolReplica({required String regionName, required UpdateReplicaStatusType status, required String userPoolId}) → Future<UpdateUserPoolReplicaResponse>
Updates replica-specific settings for a user pool replica. You can modify the status to activate or deactivate the replica. This request can be made in both primary and secondary regions of the user pool.
verifySoftwareToken({required String userCode, String? accessToken, String? friendlyDeviceName, String? session}) → Future<VerifySoftwareTokenResponse>
Registers the current user's time-based one-time password (TOTP) authenticator with a code generated in their authenticator app from a private key that's supplied by your user pool. Marks the user's software token MFA status as "verified" if successful. The request takes an access token or a session string, but not both.
verifyUserAttribute({required String accessToken, required String attributeName, required String code}) → Future<void>
Submits a verification code for a signed-in user who has added or changed a value of an auto-verified attribute. When successful, the user's attribute becomes verified and the attribute email_verified or phone_number_verified becomes true.

Operators

operator ==(Object other) → bool
The equality operator.
inherited