Amazon Cognito Federated Identities is a web service that delivers scoped temporary credentials to mobile devices and other untrusted environments. It uniquely identifies a device and supplies the user with a consistent identity over the lifetime of an application.
Using Amazon Cognito Federated Identities, you can enable authentication with one or more third-party identity providers (Facebook, Google, or Login with Amazon) or an Amazon Cognito user pool, and you can also choose to support unauthenticated access from your app. Cognito delivers a unique identifier for each user and acts as an OpenID token provider trusted by AWS Security Token Service (STS) to access temporary, limited-privilege AWS credentials.
For a description of the authentication flow from the Amazon Cognito Developer Guide see Authentication Flow.
For more information see Amazon Cognito Federated Identities.
x-logo: url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png backgroundColor: '#FFFFFF' termsOfService: https://aws.amazon.com/service-terms/ contact: name: Mike Ralphson email: mike.ralphson@gmail.com url: https://github.com/mermade/aws2openapi x-twitter: PermittedSoc license: name: Apache 2.0 License url: http://www.apache.org/licenses/ x-providerName: amazonaws.com x-serviceName: cognito-identity x-origin: - contentType: application/json url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/cognito-identity-2014-06-30.normal.json converter: url: https://github.com/mermade/aws2openapi version: 1.0.0 x-apisguru-driver: external x-apiClientRegistration: url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct x-apisguru-categories: - cloud x-preferred: true servers: - url: http://cognito-identity.{region}.amazonaws.com variables: region: description: The AWS region enum: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - us-gov-west-1 - us-gov-east-1 - ca-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - eu-central-1 - eu-south-1 - af-south-1 - ap-northeast-1 - ap-northeast-2 - ap-northeast-3 - ap-southeast-1 - ap-southeast-2 - ap-east-1 - ap-south-1 - sa-east-1 - me-south-1 default: us-east-1 description: The Amazon Cognito Identity multi-region endpoint - url: https://cognito-identity.{region}.amazonaws.com variables: region: description: The AWS region enum: - us-east-1 - us-east-2 - us-west-1 - us-west-2 - us-gov-west-1 - us-gov-east-1 - ca-central-1 - eu-north-1 - eu-west-1 - eu-west-2 - eu-west-3 - eu-central-1 - eu-south-1 - af-south-1 - ap-northeast-1 - ap-northeast-2 - ap-northeast-3 - ap-southeast-1 - ap-southeast-2 - ap-east-1 - ap-south-1 - sa-east-1 - me-south-1 default: us-east-1 description: The Amazon Cognito Identity multi-region endpoint - url: http://cognito-identity.{region}.amazonaws.com.cn variables: region: description: The AWS region enum: - cn-north-1 - cn-northwest-1 default: cn-north-1 description: The Amazon Cognito Identity endpoint for China (Beijing) and China (Ningxia) - url: https://cognito-identity.{region}.amazonaws.com.cn variables: region: description: The AWS region enum: - cn-north-1 - cn-northwest-1 default: cn-north-1 description: The Amazon Cognito Identity endpoint for China (Beijing) and China (Ningxia) security: - hmac: [] tags: - name: '#X Amz Target=AWSCognitoIdentityProviderService.SetRiskConfiguration' paths: /#X-Amz-Target=AWSCognitoIdentityProviderService.SetRiskConfiguration: parameters: - $ref: '#/components/parameters/X-Amz-Content-Sha256' - $ref: '#/components/parameters/X-Amz-Date' - $ref: '#/components/parameters/X-Amz-Algorithm' - $ref: '#/components/parameters/X-Amz-Credential' - $ref: '#/components/parameters/X-Amz-Security-Token' - $ref: '#/components/parameters/X-Amz-Signature' - $ref: '#/components/parameters/X-Amz-SignedHeaders' post: operationId: SetRiskConfiguration description:Configures actions on detected risks. To delete the risk configuration for UserPoolId or ClientId, pass null values for all four configuration types.
To activate Amazon Cognito advanced security features, update the user pool to include the UserPoolAddOns keyAdvancedSecurityMode.
The action to take in response to the account takeover action. Valid values are as follows:
BLOCK Choosing this action will block the request.
MFA_IF_CONFIGURED Present an MFA challenge if user has configured it, else allow the request.
MFA_REQUIRED Present an MFA challenge if user has configured it, else block the request.
NO_ACTION Allow the user to sign in.
From parameter.
BlockEmail:
allOf:
- $ref: '#/components/schemas/NotifyEmailType'
- description: Email template used when a detected risk event is blocked.
NoActionEmail:
allOf:
- $ref: '#/components/schemas/NotifyEmailType'
- description: The email template used when a detected risk event is allowed.
MfaEmail:
allOf:
- $ref: '#/components/schemas/NotifyEmailType'
- description: The multi-factor authentication (MFA) email template used when MFA is challenged as part of a detected risk.
description: The notify configuration type.
AccountTakeoverActionsType:
type: object
properties:
LowAction:
allOf:
- $ref: '#/components/schemas/AccountTakeoverActionType'
- description: Action to take for a low risk.
MediumAction:
allOf:
- $ref: '#/components/schemas/AccountTakeoverActionType'
- description: Action to take for a medium risk.
HighAction:
allOf:
- $ref: '#/components/schemas/AccountTakeoverActionType'
- description: Action to take for a high risk.
description: Account takeover actions type.
DateType:
type: string
format: date-time
NotifyEmailType:
type: object
required:
- Subject
properties:
Subject:
allOf:
- $ref: '#/components/schemas/EmailNotificationSubjectType'
- description: The email subject.
HtmlBody:
allOf:
- $ref: '#/components/schemas/EmailNotificationBodyType'
- description: The email HTML body.
TextBody:
allOf:
- $ref: '#/components/schemas/EmailNotificationBodyType'
- description: The email text body.
description: The notify email type.
AccountTakeoverEventActionType:
type: string
enum:
- BLOCK
- MFA_IF_CONFIGURED
- MFA_REQUIRED
- NO_ACTION
InvalidParameterException: {}
SkippedIPRangeListType:
type: array
items:
$ref: '#/components/schemas/StringType'
maxItems: 200
EventFiltersType:
type: array
items:
$ref: '#/components/schemas/EventFilterType'
AccountTakeoverActionNotifyType:
type: boolean
TooManyRequestsException: {}
InternalErrorException: {}
EmailNotificationSubjectType:
type: string
pattern: '[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+'
minLength: 1
maxLength: 140
EventFilterType:
type: string
enum:
- SIGN_IN
- PASSWORD_CHANGE
- SIGN_UP
StringType:
type: string
NotAuthorizedException: {}
CodeDeliveryFailureException: {}
ClientIdType:
type: string
pattern: '[\w+]+'
minLength: 1
maxLength: 128
format: password
AccountTakeoverRiskConfigurationType:
type: object
required:
- Actions
properties:
NotifyConfiguration:
allOf:
- $ref: '#/components/schemas/NotifyConfigurationType'
- description: The notify configuration used to construct email notifications.
Actions:
allOf:
- $ref: '#/components/schemas/AccountTakeoverActionsType'
- description: Account takeover risk configuration actions.
description: Configuration for mitigation actions and notification for different levels of risk detected for a potential account takeover.
CompromisedCredentialsActionsType:
type: object
required:
- EventAction
properties:
EventAction:
allOf:
- $ref: '#/components/schemas/CompromisedCredentialsEventActionType'
- description: The event action.
description: The compromised credentials actions type.
SetRiskConfigurationResponse:
type: object
required:
- RiskConfiguration
properties:
RiskConfiguration:
allOf:
- $ref: '#/components/schemas/RiskConfigurationType'
- description: The risk configuration.
RiskConfigurationType:
type: object
properties:
UserPoolId:
allOf:
- $ref: '#/components/schemas/UserPoolIdType'
- description: The user pool ID.
ClientId:
allOf:
- $ref: '#/components/schemas/ClientIdType'
- description: The app client ID.
CompromisedCredentialsRiskConfiguration:
allOf:
- $ref: '#/components/schemas/CompromisedCredentialsRiskConfigurationType'
- description: The compromised credentials risk configuration object, including the EventFilter and the EventAction.
AccountTakeoverRiskConfiguration:
allOf:
- $ref: '#/components/schemas/AccountTakeoverRiskConfigurationType'
- description: The account takeover risk configuration object, including the NotifyConfiguration object and Actions to take if there is an account takeover.
RiskExceptionConfiguration:
allOf:
- $ref: '#/components/schemas/RiskExceptionConfigurationType'
- description: The configuration to override the risk decision.
LastModifiedDate:
allOf:
- $ref: '#/components/schemas/DateType'
- description: The last modified date.
description: The risk configuration type.
SetRiskConfigurationRequest:
type: object
required:
- UserPoolId
title: SetRiskConfigurationRequest
properties:
UserPoolId:
allOf:
- $ref: '#/components/schemas/UserPoolIdType'
- description: 'The user pool ID. '
ClientId:
allOf:
- $ref: '#/components/schemas/ClientIdType'
- description: The app client ID. If ClientId is null, then the risk configuration is mapped to userPoolId. When the client ID is null, the same risk configuration is applied to all the clients in the userPool.
Otherwise, ClientId is mapped to the client. When the client ID isn't null, the user pool configuration is overridden and the risk configuration for the client is used instead.