Amazon Cognito Cognito User Pool Client Secret API

openapi: 3.2.0
info:
  title: Amazon Cognito Identity Provider User Pool Client Secret API
  version: '2016-04-18'
  description: Generated from AWS's published Smithy model for Amazon Cognito Identity Provider. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://cognito-idp.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: User Pool Client Secret
paths:
  /#AddUserPoolClientSecret:
    post:
      operationId: AddUserPoolClientSecret
      summary: Add User Pool Client Secret
      description: Creates a new client secret for an existing confidential user pool app client. Supports up to 2 active secrets per app client for zero-downtime credential rotation workflows.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AddUserPoolClientSecretResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '400':
          description: InvalidParameterException; LimitExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: TooManyRequestsException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSCognitoIdentityProviderService.AddUserPoolClientSecret
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/AddUserPoolClientSecretRequest'
      tags:
      - User Pool Client Secret
  /#DeleteUserPoolClientSecret:
    post:
      operationId: DeleteUserPoolClientSecret
      summary: Delete User Pool Client Secret
      description: Deletes a specific client secret from a user pool app client. You cannot delete the last remaining secret for an app client.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/DeleteUserPoolClientSecretResponse'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '400':
          description: InvalidParameterException; LimitExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: TooManyRequestsException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSCognitoIdentityProviderService.DeleteUserPoolClientSecret
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeleteUserPoolClientSecretRequest'
      tags:
      - User Pool Client Secret
  /#ListUserPoolClientSecrets:
    post:
      operationId: ListUserPoolClientSecrets
      summary: List User Pool Client Secrets
      description: Lists all client secrets associated with a user pool app client. Returns metadata about the secrets. The response does not include pagination tokens as there are only 2 secrets at any given time and we return both with every ListUserPoolClientSecrets call. For security reasons, the response never reveals the actual secret value in ClientSecretValue.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListUserPoolClientSecretsResponse'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '400':
          description: InvalidParameterException; LimitExceededException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidParameterException'
        '404':
          description: ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: TooManyRequestsException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/TooManyRequestsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSCognitoIdentityProviderService.ListUserPoolClientSecrets
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListUserPoolClientSecretsRequest'
      tags:
      - User Pool Client Secret
components:
  schemas:
    ClientSecretDescriptorType:
      type: object
      properties:
        ClientSecretId:
          type: string
          description: The unique identifier for the client secret. This identifier follows the format --.
        ClientSecretValue:
          type: string
          description: The actual secret value. This is only returned when creating a new secret and only if Amazon Cognito generated the secret. For custom secrets that you provide, this field is not included in the response.
        ClientSecretCreateDate:
          type: string
          format: date-time
          description: The date and time when the client secret was created.
    TooManyRequestsException:
      type: object
      properties:
        message:
          type: string
          description: The message returned when the Amazon Cognito service returns a too many requests exception.
    DeleteUserPoolClientSecretRequest:
      type: object
      properties:
        UserPoolId:
          type: string
          description: The ID of the user pool that contains the app client.
        ClientId:
          type: string
          description: The ID of the app client from which you want to delete the secret.
        ClientSecretId:
          type: string
          description: The unique identifier of the client secret you want to delete.
      required:
      - UserPoolId
      - ClientId
      - ClientSecretId
    AccessDeniedException:
      type: object
      properties:
        message:
          type: string
    ListUserPoolClientSecretsRequest:
      type: object
      properties:
        UserPoolId:
          type: string
          description: The ID of the user pool that contains the app client.
        ClientId:
          type: string
          description: The ID of the app client whose secrets you want to list.
        NextToken:
          type: string
          description: This API operation returns a limited number of results. The pagination token is an identifier that you can present in an additional API request with the same parameters. When you include the pagination token, Amazon Cognito returns the next set of items after the current list. Subsequent requests return a new pagination token. By use of this token, you can paginate through the full list of items.
      required:
      - UserPoolId
      - ClientId
    ResourceNotFoundException:
      type: object
      properties:
        message:
          type: string
          description: The message returned when the Amazon Cognito service returns a resource not found exception.
    ListUserPoolClientSecretsResponse:
      type: object
      properties:
        ClientSecrets:
          type: array
          items:
            $ref: '#/components/schemas/ClientSecretDescriptorType'
          description: A list of client secret descriptors containing the identifier and creation date for each secret. For security reasons, the response never reveals the actual secret value in ClientSecretValue.
        NextToken:
          type: string
          description: The identifier that Amazon Cognito returned with the previous request to this operation. When you include a pagination token in your request, Amazon Cognito returns the next set of items in the list. By use of this token, you can paginate through the full list of items.
    DeleteUserPoolClientSecretResponse:
      type: object
      properties: {}
    AddUserPoolClientSecretResponse:
      type: object
      properties:
        ClientSecretDescriptor:
          $ref: '#/components/schemas/ClientSecretDescriptorType'
    InvalidParameterException:
      type: object
      properties:
        message:
          type: string
          description: The message returned when the Amazon Cognito service throws an invalid parameter exception.
        reasonCode:
          type: string
          description: The reason code of the exception.
    InternalServerException:
      type: object
      properties:
        message:
          type: string
    AddUserPoolClientSecretRequest:
      type: object
      properties:
        UserPoolId:
          type: string
          description: The ID of the user pool that contains the app client.
        ClientId:
          type: string
          description: The ID of the app client for which you want to create a new secret.
        ClientSecret:
          type: string
          description: The client secret value you want to use. If you don't provide this parameter, Amazon Cognito generates a secure secret for you.
      required:
      - UserPoolId
      - ClientId
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: cognito-idp
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/cognito-identity-provider/service/2016-04-18/cognito-identity-provider-2016-04-18.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)