Cognito operations
Every Cognito operation Overcast declares — 70 of 70 implemented — with status, behaviour notes and a link to the AWS API reference for each.
All 70 listed operations are implemented. Back to Cognito.
Summary
| Category | ✅ Supported |
|---|---|
| User Pool operations | 7 |
| User Pool Client operations | 5 |
| User operations | 10 |
| Auth / Token operations | 32 |
| Group operations | 9 |
| User Pool Domain operations | 4 |
| Tags | 3 |
Endpoints
User Pool operations
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateUserPool | ✅ Supported | Returns Id and Arn; Id format {region}_{8-char-hex}; accepts SignInPolicy, email templates, UserAttributeUpdateSettings, DeviceConfiguration, AliasAttributes, AccountRecoverySetting, SmsConfiguration, SmsAuthenticationMessage, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, and LambdaConfig; LambdaConfig’s PreSignUp, PostConfirmation, PreTokenGeneration, PostAuthentication, and CustomMessage are invoked on the classic X-Amz-Target API (issue #1171); PreAuthentication, UserMigration, the CUSTOM_AUTH challenge triggers (#88/#94/#101), and the Smithy RPC v2 duplicate dispatch path are not | docs |
DescribeUserPool | ✅ Supported | Returns SignInPolicy, email templates, admin config, email configuration, UserAttributeUpdateSettings, AliasAttributes, AccountRecoverySetting, SmsConfiguration, SmsAuthenticationMessage, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, and LambdaConfig | docs |
DeleteUserPool | ✅ Supported | ResourceNotFoundException if not found | docs |
UpdateUserPool | ✅ Supported | Updates SignInPolicy, VerificationMessageTemplate, AdminCreateUserConfig, EmailConfiguration, UserAttributeUpdateSettings, DeviceConfiguration, AccountRecoverySetting, SmsConfiguration, SmsAuthenticationMessage, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, and LambdaConfig; the CloudFormation UserPool handler treats an AliasAttributes/UsernameAttributes change as requiring replacement, matching real Cognito’s UpdateUserPoolRequest (neither is a member there) | docs |
ListUserPools | ✅ Supported | Pagination via NextToken | docs |
SetUserPoolMfaConfig | ✅ Supported | Stores MfaConfiguration and WebAuthnConfiguration for passkey sign-in; passkey cryptographic validation is intentionally partial | docs |
GetUserPoolMfaConfig | ✅ Supported | Returns stored MfaConfiguration and WebAuthnConfiguration | docs |
User Pool Client operations
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateUserPoolClient | ✅ Supported | Returns ClientId (26-char hex); accepts and validates ExplicitAuthFlows, AccessTokenValidity, IdTokenValidity, RefreshTokenValidity, TokenValidityUnits, PreventUserExistenceErrors, ReadAttributes, WriteAttributes | docs |
DescribeUserPoolClient | ✅ Supported | ResourceNotFoundException if not found | docs |
DeleteUserPoolClient | ✅ Supported | ResourceNotFoundException if not found | docs |
UpdateUserPoolClient | ✅ Supported | Updates client name, validates ExplicitAuthFlows, token validity, PreventUserExistenceErrors, ReadAttributes, WriteAttributes | docs |
ListUserPoolClients | ✅ Supported | Pagination via NextToken | docs |
User operations
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
AdminCreateUser | ✅ Supported | Bcrypt hashes password; sends email unless MessageAction=SUPPRESS; invokes PreSignUp_AdminCreateUser (its autoConfirm/autoVerify response fields are ignored, matching AWS) and CustomMessage_AdminCreateUser (issue #1171) | docs |
AdminDeleteUser | ✅ Supported | UserNotFoundException if not found | docs |
AdminGetUser | ✅ Supported | Returns attributes + status | docs |
AdminSetUserPassword | ✅ Supported | Permanent=true sets status CONFIRMED | docs |
AdminConfirmSignUp | ✅ Supported | Confirms a UNCONFIRMED user; invokes PostConfirmation_ConfirmSignUp fire-and-forget — a trigger error is logged but does not fail the call or roll back the confirmation (issue #1171) | docs |
AdminUpdateUserAttributes | ✅ Supported | Merges attributes; honors verification-before-update settings unless *_verified=true is supplied | docs |
AdminDeleteUserAttributes | ✅ Supported | Removes named attributes from a user | docs |
AdminDisableUser | ✅ Supported | Sets Enabled=false; sign-in returns NotAuthorizedException | docs |
AdminEnableUser | ✅ Supported | Re-enables a disabled user | docs |
ListUsers | ✅ Supported | Pagination via PaginationToken | docs |
Auth / Token operations
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
SignUp | ✅ Supported | Sends confirmation email; returns UserSub; invokes PreSignUp_SignUp (autoConfirmUser/autoVerifyEmail/autoVerifyPhone honored — an auto-confirmed user also fires PostConfirmation_ConfirmSignUp within the same call, and no confirmation message is sent) and CustomMessage_SignUp; either failing fails SignUp with UserLambdaValidationException (issue #1171) | docs |
ConfirmSignUp | ✅ Supported | CodeMismatchException / ExpiredCodeException on failure; returns Session for USER_AUTH sign-in; invokes PostConfirmation_ConfirmSignUp fire-and-forget (issue #1171) | docs |
ResendConfirmationCode | ✅ Supported | Generates and emails a new confirmation code; invokes CustomMessage_ResendCode, failing the call on a trigger error (issue #1171) | docs |
InitiateAuth | ✅ Supported | USER_PASSWORD_AUTH + USER_SRP_AUTH + REFRESH_TOKEN_AUTH + CUSTOM_AUTH; USER_AUTH with ConfirmSignUp Session, SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, or preferred PASSWORD/WEB_AUTHN/EMAIL_OTP/SMS_OTP; returns NEW_PASSWORD_REQUIRED, SOFTWARE_TOKEN_MFA, or DEVICE_SRP_AUTH; a completed authentication invokes PostAuthentication_Authentication then PreTokenGeneration (TokenGeneration_Authentication/_RefreshTokens/_NewPasswordChallenge/_AuthenticateDevice as appropriate), each able to fail the call (issue #1171) | docs |
AdminInitiateAuth | ✅ Supported | USER_PASSWORD_AUTH + USER_SRP_AUTH + REFRESH_TOKEN_AUTH + CUSTOM_AUTH with UserPoolId; USER_AUTH with ConfirmSignUp Session, SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, or preferred PASSWORD/WEB_AUTHN/EMAIL_OTP/SMS_OTP; same PostAuthentication/PreTokenGeneration trigger invocation as InitiateAuth (issue #1171) | docs |
RespondToAuthChallenge | ✅ Supported | SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, PASSWORD, PASSWORD_VERIFIER, CUSTOM_CHALLENGE, DEVICE_SRP_AUTH, DEVICE_PASSWORD_VERIFIER, WEB_AUTHN, EMAIL_OTP, SMS_OTP, NEW_PASSWORD_REQUIRED, and SOFTWARE_TOKEN_MFA challenges; a challenge completion that issues tokens invokes PostAuthentication_Authentication (skipped for NEW_PASSWORD_REQUIRED) then PreTokenGeneration, each able to fail the call (issue #1171) | docs |
AdminRespondToAuthChallenge | ✅ Supported | Same as above with admin credentials, including the same trigger invocation (issue #1171) | docs |
ConfirmDevice | ✅ Supported | Confirms a NewDeviceMetadata device key and stores remembered-device metadata; SRP verifier validation is intentionally partial | docs |
GetDevice | ✅ Supported | Returns a confirmed device for the signed-in user | docs |
ListDevices | ✅ Supported | Lists confirmed devices for the signed-in user | docs |
UpdateDeviceStatus | ✅ Supported | Marks a signed-in user’s confirmed device as remembered or not_remembered | docs |
ForgetDevice | ✅ Supported | Removes a confirmed device for the signed-in user | docs |
AdminGetDevice | ✅ Supported | Returns a user’s confirmed device | docs |
AdminListDevices | ✅ Supported | Lists a user’s confirmed devices with pagination | docs |
AdminUpdateDeviceStatus | ✅ Supported | Marks a user’s confirmed device as remembered or not_remembered | docs |
AdminForgetDevice | ✅ Supported | Removes a user’s confirmed device | docs |
ForgotPassword | ✅ Supported | Sends password-reset code by email; invokes CustomMessage_ForgotPassword, failing the call on a trigger error (issue #1171) | docs |
ConfirmForgotPassword | ✅ Supported | Validates reset code; sets new bcrypt password; invokes PostConfirmation_ConfirmForgotPassword fire-and-forget (issue #1171) | docs |
ChangePassword | ✅ Supported | Validates AccessToken + old password before setting new one | docs |
GetUser | ✅ Supported | Validates AccessToken; returns full user profile | docs |
UpdateUserAttributes | ✅ Supported | Self-service; validates AccessToken; merges attributes or creates pending email/phone updates with CodeDeliveryDetailsList | docs |
VerifyUserAttribute | ✅ Supported | Verifies pending email/phone updates and sets *_verified=true | docs |
GetUserAttributeVerificationCode | ✅ Supported | Sends or resends email/phone verification codes for the signed-in user | docs |
DeleteUserAttributes | ✅ Supported | Self-service; validates AccessToken; removes named attributes | docs |
GlobalSignOut | ✅ Supported | Revokes access + id + refresh tokens for the user | docs |
RevokeToken | ✅ Supported | Revokes a specific refresh token | docs |
AssociateSoftwareToken | ✅ Supported | Issues a TOTP secret for the user; requires valid AccessToken | docs |
VerifySoftwareToken | ✅ Supported | Verifies a TOTP code and marks the secret verified | docs |
StartWebAuthnRegistration | ✅ Supported | Returns passkey CredentialCreationOptions for the signed-in user | docs |
CompleteWebAuthnRegistration | ✅ Supported | Registers passkey credential metadata; attestation validation is intentionally partial | docs |
SetUserMFAPreference | ✅ Supported | Enables/disables TOTP MFA for the calling user | docs |
AdminSetUserMFAPreference | ✅ Supported | Same as above, admin version | docs |
Group operations
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateGroup | ✅ Supported | GroupExistsException if duplicate | docs |
GetGroup | ✅ Supported | ResourceNotFoundException if not found | docs |
DeleteGroup | ✅ Supported | ResourceNotFoundException if not found | docs |
UpdateGroup | ✅ Supported | Updates Description, Precedence, RoleArn | docs |
ListGroups | ✅ Supported | Returns all groups for a pool | docs |
AdminAddUserToGroup | ✅ Supported | Idempotent | docs |
AdminRemoveUserFromGroup | ✅ Supported | No error if user is not in group | docs |
AdminListGroupsForUser | ✅ Supported | Returns groups the user belongs to | docs |
ListUsersInGroup | ✅ Supported | Returns users belonging to the specified group | docs |
User Pool Domain operations
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateUserPoolDomain | ✅ Supported | Associates a domain with the user pool’s hosted UI | docs |
DescribeUserPoolDomain | ✅ Supported | Returns domain details; empty DomainDescription when domain not found | docs |
DeleteUserPoolDomain | ✅ Supported | Removes the domain association from the pool | docs |
UpdateUserPoolDomain | ✅ Supported | Accepted; SSL certificate updates are inert in the emulator | docs |
Tags
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
TagResource | ✅ Supported | docs | |
UntagResource | ✅ Supported | docs | |
ListTagsForResource | ✅ Supported | docs |
Related
- Cognito — quick start, what works, and the differences from AWS
- All service pages