# Cognito operations All 70 listed operations are implemented. Back to [Cognito](/docs/services/cognito/index.md). ## Summary | Category | ✅ Supported | | --- | --- | | User Pool operations | 7 | | User Pool Client operations | 5 | | User operations | 10 | | Auth / Token operations | 32 | | Group operations | 9 | | User Pool Domain operations | 4 | | Tags | 3 | --- ## Endpoints ### User Pool operations | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateUserPool` | ✅ Supported | Returns Id and Arn; Id format {region}_{8-char-hex}; accepts SignInPolicy, email templates, UserAttributeUpdateSettings, DeviceConfiguration, AliasAttributes, AccountRecoverySetting, SmsConfiguration, SmsAuthenticationMessage, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, and LambdaConfig; LambdaConfig's PreSignUp, PostConfirmation, PreTokenGeneration, PostAuthentication, and CustomMessage are invoked on the classic X-Amz-Target API (issue #1171); PreAuthentication, UserMigration, the CUSTOM_AUTH challenge triggers (#88/#94/#101), and the Smithy RPC v2 duplicate dispatch path are not | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.html) | | `DescribeUserPool` | ✅ Supported | Returns SignInPolicy, email templates, admin config, email configuration, UserAttributeUpdateSettings, AliasAttributes, AccountRecoverySetting, SmsConfiguration, SmsAuthenticationMessage, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, and LambdaConfig | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html) | | `DeleteUserPool` | ✅ Supported | ResourceNotFoundException if not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPool.html) | | `UpdateUserPool` | ✅ Supported | Updates SignInPolicy, VerificationMessageTemplate, AdminCreateUserConfig, EmailConfiguration, UserAttributeUpdateSettings, DeviceConfiguration, AccountRecoverySetting, SmsConfiguration, SmsAuthenticationMessage, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, and LambdaConfig; the CloudFormation UserPool handler treats an AliasAttributes/UsernameAttributes change as requiring replacement, matching real Cognito's UpdateUserPoolRequest (neither is a member there) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPool.html) | | `ListUserPools` | ✅ Supported | Pagination via NextToken | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPools.html) | | `SetUserPoolMfaConfig` | ✅ Supported | Stores MfaConfiguration and WebAuthnConfiguration for passkey sign-in; passkey cryptographic validation is intentionally partial | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserPoolMfaConfig.html) | | `GetUserPoolMfaConfig` | ✅ Supported | Returns stored MfaConfiguration and WebAuthnConfiguration | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserPoolMfaConfig.html) | ### User Pool Client operations | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateUserPoolClient` | ✅ Supported | Returns ClientId (26-char hex); accepts and validates ExplicitAuthFlows, AccessTokenValidity, IdTokenValidity, RefreshTokenValidity, TokenValidityUnits, PreventUserExistenceErrors, ReadAttributes, WriteAttributes | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html) | | `DescribeUserPoolClient` | ✅ Supported | ResourceNotFoundException if not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolClient.html) | | `DeleteUserPoolClient` | ✅ Supported | ResourceNotFoundException if not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClient.html) | | `UpdateUserPoolClient` | ✅ Supported | Updates client name, validates ExplicitAuthFlows, token validity, PreventUserExistenceErrors, ReadAttributes, WriteAttributes | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolClient.html) | | `ListUserPoolClients` | ✅ Supported | Pagination via NextToken | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClients.html) | ### User operations | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `AdminCreateUser` | ✅ Supported | Bcrypt hashes password; sends email unless MessageAction=SUPPRESS; invokes PreSignUp_AdminCreateUser (its autoConfirm/autoVerify response fields are ignored, matching AWS) and CustomMessage_AdminCreateUser (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html) | | `AdminDeleteUser` | ✅ Supported | UserNotFoundException if not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUser.html) | | `AdminGetUser` | ✅ Supported | Returns attributes + status | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html) | | `AdminSetUserPassword` | ✅ Supported | Permanent=true sets status CONFIRMED | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html) | | `AdminConfirmSignUp` | ✅ Supported | Confirms a UNCONFIRMED user; invokes PostConfirmation_ConfirmSignUp fire-and-forget — a trigger error is logged but does not fail the call or roll back the confirmation (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminConfirmSignUp.html) | | `AdminUpdateUserAttributes` | ✅ Supported | Merges attributes; honors verification-before-update settings unless *_verified=true is supplied | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html) | | `AdminDeleteUserAttributes` | ✅ Supported | Removes named attributes from a user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUserAttributes.html) | | `AdminDisableUser` | ✅ Supported | Sets Enabled=false; sign-in returns NotAuthorizedException | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableUser.html) | | `AdminEnableUser` | ✅ Supported | Re-enables a disabled user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminEnableUser.html) | | `ListUsers` | ✅ Supported | Pagination via PaginationToken | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html) | ### Auth / Token operations | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `SignUp` | ✅ Supported | Sends confirmation email; returns UserSub; invokes PreSignUp_SignUp (autoConfirmUser/autoVerifyEmail/autoVerifyPhone honored — an auto-confirmed user also fires PostConfirmation_ConfirmSignUp within the same call, and no confirmation message is sent) and CustomMessage_SignUp; either failing fails SignUp with UserLambdaValidationException (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignUp.html) | | `ConfirmSignUp` | ✅ Supported | CodeMismatchException / ExpiredCodeException on failure; returns Session for USER_AUTH sign-in; invokes PostConfirmation_ConfirmSignUp fire-and-forget (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmSignUp.html) | | `ResendConfirmationCode` | ✅ Supported | Generates and emails a new confirmation code; invokes CustomMessage_ResendCode, failing the call on a trigger error (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResendConfirmationCode.html) | | `InitiateAuth` | ✅ Supported | USER_PASSWORD_AUTH + USER_SRP_AUTH + REFRESH_TOKEN_AUTH + CUSTOM_AUTH; USER_AUTH with ConfirmSignUp Session, SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, or preferred PASSWORD/WEB_AUTHN/EMAIL_OTP/SMS_OTP; returns NEW_PASSWORD_REQUIRED, SOFTWARE_TOKEN_MFA, or DEVICE_SRP_AUTH; a completed authentication invokes PostAuthentication_Authentication then PreTokenGeneration (TokenGeneration_Authentication/_RefreshTokens/_NewPasswordChallenge/_AuthenticateDevice as appropriate), each able to fail the call (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html) | | `AdminInitiateAuth` | ✅ Supported | USER_PASSWORD_AUTH + USER_SRP_AUTH + REFRESH_TOKEN_AUTH + CUSTOM_AUTH with UserPoolId; USER_AUTH with ConfirmSignUp Session, SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, or preferred PASSWORD/WEB_AUTHN/EMAIL_OTP/SMS_OTP; same PostAuthentication/PreTokenGeneration trigger invocation as InitiateAuth (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html) | | `RespondToAuthChallenge` | ✅ Supported | SELECT_CHALLENGE/PASSWORD/PASSWORD_SRP/WEB_AUTHN/EMAIL_OTP/SMS_OTP, PASSWORD, PASSWORD_VERIFIER, CUSTOM_CHALLENGE, DEVICE_SRP_AUTH, DEVICE_PASSWORD_VERIFIER, WEB_AUTHN, EMAIL_OTP, SMS_OTP, NEW_PASSWORD_REQUIRED, and SOFTWARE_TOKEN_MFA challenges; a challenge completion that issues tokens invokes PostAuthentication_Authentication (skipped for NEW_PASSWORD_REQUIRED) then PreTokenGeneration, each able to fail the call (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RespondToAuthChallenge.html) | | `AdminRespondToAuthChallenge` | ✅ Supported | Same as above with admin credentials, including the same trigger invocation (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRespondToAuthChallenge.html) | | `ConfirmDevice` | ✅ Supported | Confirms a NewDeviceMetadata device key and stores remembered-device metadata; SRP verifier validation is intentionally partial | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmDevice.html) | | `GetDevice` | ✅ Supported | Returns a confirmed device for the signed-in user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetDevice.html) | | `ListDevices` | ✅ Supported | Lists confirmed devices for the signed-in user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListDevices.html) | | `UpdateDeviceStatus` | ✅ Supported | Marks a signed-in user's confirmed device as remembered or not_remembered | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.html) | | `ForgetDevice` | ✅ Supported | Removes a confirmed device for the signed-in user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgetDevice.html) | | `AdminGetDevice` | ✅ Supported | Returns a user's confirmed device | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetDevice.html) | | `AdminListDevices` | ✅ Supported | Lists a user's confirmed devices with pagination | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListDevices.html) | | `AdminUpdateDeviceStatus` | ✅ Supported | Marks a user's confirmed device as remembered or not_remembered | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateDeviceStatus.html) | | `AdminForgetDevice` | ✅ Supported | Removes a user's confirmed device | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminForgetDevice.html) | | `ForgotPassword` | ✅ Supported | Sends password-reset code by email; invokes CustomMessage_ForgotPassword, failing the call on a trigger error (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.html) | | `ConfirmForgotPassword` | ✅ Supported | Validates reset code; sets new bcrypt password; invokes PostConfirmation_ConfirmForgotPassword fire-and-forget (issue #1171) | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmForgotPassword.html) | | `ChangePassword` | ✅ Supported | Validates AccessToken + old password before setting new one | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ChangePassword.html) | | `GetUser` | ✅ Supported | Validates AccessToken; returns full user profile | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html) | | `UpdateUserAttributes` | ✅ Supported | Self-service; validates AccessToken; merges attributes or creates pending email/phone updates with CodeDeliveryDetailsList | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.html) | | `VerifyUserAttribute` | ✅ Supported | Verifies pending email/phone updates and sets *_verified=true | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifyUserAttribute.html) | | `GetUserAttributeVerificationCode` | ✅ Supported | Sends or resends email/phone verification codes for the signed-in user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAttributeVerificationCode.html) | | `DeleteUserAttributes` | ✅ Supported | Self-service; validates AccessToken; removes named attributes | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserAttributes.html) | | `GlobalSignOut` | ✅ Supported | Revokes access + id + refresh tokens for the user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html) | | `RevokeToken` | ✅ Supported | Revokes a specific refresh token | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.html) | | `AssociateSoftwareToken` | ✅ Supported | Issues a TOTP secret for the user; requires valid AccessToken | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssociateSoftwareToken.html) | | `VerifySoftwareToken` | ✅ Supported | Verifies a TOTP code and marks the secret verified | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifySoftwareToken.html) | | `StartWebAuthnRegistration` | ✅ Supported | Returns passkey CredentialCreationOptions for the signed-in user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartWebAuthnRegistration.html) | | `CompleteWebAuthnRegistration` | ✅ Supported | Registers passkey credential metadata; attestation validation is intentionally partial | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CompleteWebAuthnRegistration.html) | | `SetUserMFAPreference` | ✅ Supported | Enables/disables TOTP MFA for the calling user | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserMFAPreference.html) | | `AdminSetUserMFAPreference` | ✅ Supported | Same as above, admin version | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserMFAPreference.html) | ### Group operations | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateGroup` | ✅ Supported | GroupExistsException if duplicate | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateGroup.html) | | `GetGroup` | ✅ Supported | ResourceNotFoundException if not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetGroup.html) | | `DeleteGroup` | ✅ Supported | ResourceNotFoundException if not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteGroup.html) | | `UpdateGroup` | ✅ Supported | Updates Description, Precedence, RoleArn | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateGroup.html) | | `ListGroups` | ✅ Supported | Returns all groups for a pool | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListGroups.html) | | `AdminAddUserToGroup` | ✅ Supported | Idempotent | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminAddUserToGroup.html) | | `AdminRemoveUserFromGroup` | ✅ Supported | No error if user is not in group | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRemoveUserFromGroup.html) | | `AdminListGroupsForUser` | ✅ Supported | Returns groups the user belongs to | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListGroupsForUser.html) | | `ListUsersInGroup` | ✅ Supported | Returns users belonging to the specified group | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.html) | ### User Pool Domain operations | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateUserPoolDomain` | ✅ Supported | Associates a domain with the user pool's hosted UI | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolDomain.html) | | `DescribeUserPoolDomain` | ✅ Supported | Returns domain details; empty DomainDescription when domain not found | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolDomain.html) | | `DeleteUserPoolDomain` | ✅ Supported | Removes the domain association from the pool | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolDomain.html) | | `UpdateUserPoolDomain` | ✅ Supported | Accepted; SSL certificate updates are inert in the emulator | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolDomain.html) | ### Tags | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `TagResource` | ✅ Supported | | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TagResource.html) | | `UntagResource` | ✅ Supported | | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UntagResource.html) | | `ListTagsForResource` | ✅ Supported | | [docs](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTagsForResource.html) | ## Related - [Cognito](/docs/services/cognito/index.md) — quick start, what works, and the differences from AWS - [All service pages](/docs/services/index.md)