SignUp | ✅ Supported | Sends confirmation email; returns UserSub; invokes PreSignUp_SignUp (autoConfirmUser/autoVerifyEmail/autoVerifyPhone honored — an auto-confirmed user also fires PostConfirmation_ConfirmSignUp within the same call, and no confirmation message is sent) and CustomMessage_SignUp; either failing fails SignUp with UserLambdaValidationException (issue #1171) | docs |
ConfirmSignUp | ✅ Supported | CodeMismatchException / ExpiredCodeException on failure; returns Session for USER_AUTH sign-in; invokes PostConfirmation_ConfirmSignUp fire-and-forget (issue #1171) | docs |
ResendConfirmationCode | ✅ Supported | Generates and emails a new confirmation code; invokes CustomMessage_ResendCode, failing the call on a trigger error (issue #1171) | docs |
InitiateAuth | ✅ Supported | USER_PASSWORD_AUTH + USER_SRP_AUTH + REFRESH_TOKEN_AUTH + CUSTOM_AUTH; USER_AUTH with ConfirmSignUp Session, SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, or preferred PASSWORD/WEB_AUTHN/EMAIL_OTP/SMS_OTP; returns NEW_PASSWORD_REQUIRED, DEVICE_SRP_AUTH, or an MFA challenge — SMS_MFA (code stored on the user, masked CODE_DELIVERY_DESTINATION), SOFTWARE_TOKEN_MFA, SELECT_MFA_TYPE with MFAS_CAN_CHOOSE when both are active, or MFA_SETUP with MFAS_CAN_SETUP when MfaConfiguration is ON and the user has no factor; email MFA is never challenged; a completed authentication invokes PostAuthentication_Authentication then PreTokenGeneration (TokenGeneration_Authentication/_RefreshTokens/_NewPasswordChallenge/_AuthenticateDevice as appropriate), each able to fail the call (issue #1171); USER_SRP_AUTH/PASSWORD_SRP proofs are accepted once the SRP claim fields are present and are not cryptographically verified; WebAuthn assertion signature validation is intentionally partial | docs |
AdminInitiateAuth | ✅ Supported | USER_PASSWORD_AUTH + USER_SRP_AUTH + REFRESH_TOKEN_AUTH + CUSTOM_AUTH with UserPoolId; USER_AUTH with ConfirmSignUp Session, SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, or preferred PASSWORD/WEB_AUTHN/EMAIL_OTP/SMS_OTP; same PostAuthentication/PreTokenGeneration trigger invocation as InitiateAuth (issue #1171); same SRP verification boundary as InitiateAuth — proofs are accepted once the claim fields are present, not cryptographically verified | docs |
RespondToAuthChallenge | ✅ Supported | SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, PASSWORD, PASSWORD_VERIFIER, CUSTOM_CHALLENGE, DEVICE_SRP_AUTH, DEVICE_PASSWORD_VERIFIER, WEB_AUTHN, EMAIL_OTP, SMS_OTP, NEW_PASSWORD_REQUIRED, SOFTWARE_TOKEN_MFA, SMS_MFA, SELECT_MFA_TYPE, and MFA_SETUP challenges; SMS_MFA takes SMS_MFA_CODE and answers a wrong code with CodeMismatchException, SELECT_MFA_TYPE takes ANSWER and rejects an inactive factor with MFAMethodNotFoundException, and MFA_SETUP completes once AssociateSoftwareToken/VerifySoftwareToken have verified a software token against the challenge Session; a challenge completion that issues tokens invokes PostAuthentication_Authentication (skipped for NEW_PASSWORD_REQUIRED) then PreTokenGeneration, each able to fail the call (issue #1171); PASSWORD_VERIFIER/DEVICE_PASSWORD_VERIFIER accept the SRP claim fields without cryptographic proof verification, and WEB_AUTHN accepts the credential response without cryptographic assertion signature verification | docs |
AdminRespondToAuthChallenge | ✅ Supported | Same as above with admin credentials, including the same trigger invocation (issue #1171); same SRP/WebAuthn verification boundary as RespondToAuthChallenge | docs |
ConfirmDevice | ✅ Supported | Confirms a NewDeviceMetadata device key and stores remembered-device metadata; SRP verifier validation is intentionally partial | docs |
GetDevice | ✅ Supported | Returns a confirmed device for the signed-in user | docs |
ListDevices | ✅ Supported | Lists confirmed devices for the signed-in user | docs |
UpdateDeviceStatus | ✅ Supported | Marks a signed-in user’s confirmed device as remembered or not_remembered | docs |
ForgetDevice | ✅ Supported | Removes a confirmed device for the signed-in user | docs |
AdminGetDevice | ✅ Supported | Returns a user’s confirmed device; IAM authorization on the requested user is stored but not enforced unless OVERCAST_ENFORCE_IAM is set, the same project-wide behavior as every other operation; DeviceAttributes names (device_status, device_name, dev:device_remembered_status) are emulator choices where AWS’s list is unconstrained | docs |
AdminListDevices | ✅ Supported | Lists a user’s confirmed devices with pagination; PaginationToken is an emulator-internal integer offset rather than AWS’s opaque token, and Limit accepts 0-60 matching the model’s QueryLimitType | docs |
AdminUpdateDeviceStatus | ✅ Supported | Marks a user’s confirmed device as remembered or not_remembered | docs |
AdminForgetDevice | ✅ Supported | Removes a user’s confirmed device | docs |
ForgotPassword | ✅ Supported | Sends password-reset code by email; invokes CustomMessage_ForgotPassword, failing the call on a trigger error (issue #1171) | docs |
ConfirmForgotPassword | ✅ Supported | Validates reset code; sets new bcrypt password; invokes PostConfirmation_ConfirmForgotPassword fire-and-forget (issue #1171) | docs |
ChangePassword | ✅ Supported | Validates AccessToken + old password before setting new one | docs |
GetUser | ✅ Supported | Validates AccessToken; returns full user profile | docs |
UpdateUserAttributes | ✅ Supported | Self-service; validates AccessToken; merges attributes, creates pending email/phone updates where AttributesRequireVerificationBeforeUpdate gates them, or — for an attribute in the pool’s AutoVerifiedAttributes that is not gated — applies the new value, clears email_verified/phone_number_verified and sends a code; either way the response carries CodeDeliveryDetailsList with the destination masked | docs |
VerifyUserAttribute | ✅ Supported | Verifies pending email/phone updates and sets *_verified=true | docs |
GetUserAttributeVerificationCode | ✅ Supported | Sends or resends email/phone verification codes for the signed-in user | docs |
DeleteUserAttributes | ✅ Supported | Self-service; validates AccessToken; removes named attributes | docs |
GlobalSignOut | ✅ Supported | Revokes access + id + refresh tokens for the user | docs |
RevokeToken | ✅ Supported | Revokes a specific refresh token | docs |
AssociateSoftwareToken | ✅ Supported | Issues a TOTP secret for the user; requires valid AccessToken | docs |
VerifySoftwareToken | ✅ Supported | Verifies a TOTP code and marks the secret verified | docs |
StartWebAuthnRegistration | ✅ Supported | Returns passkey CredentialCreationOptions for the signed-in user; the registration challenge expires after 5 minutes (WebAuthnChallengeNotFoundException from CompleteWebAuthnRegistration), but AWS’s exact WebAuthn error taxonomy for expired, mismatched, or replayed challenges is not reproduced | docs |
CompleteWebAuthnRegistration | ✅ Supported | Registers passkey credential metadata; attestation validation is intentionally partial | docs |
SetUserMFAPreference | ✅ Supported | Enables/disables TOTP MFA (SoftwareTokenMfaSettings) and SMS MFA (SMSMfaSettings) for the calling user, records PreferredMfa, and reports both through GetUser/AdminGetUser as UserMFASettingList and PreferredMfaSetting; enabling SMS MFA for a user with no phone_number is rejected with InvalidParameterException; EmailMfaSettings is accepted by the wire shape and dropped, because no email MFA challenge is issued | docs |
AdminSetUserMFAPreference | ✅ Supported | Same as above, admin version, identified by UserPoolId and Username | docs |
