Class: AWS.CognitoIdentity

var params = {
  IdentityIdsToDelete: [ /* required */
    'STRING_VALUE',
    /* more items */
  ]
};
cognitoidentity.deleteIdentities(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityIdsToDelete — (Array<String>)

    A list of 1-60 identities that you want to delete.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • UnprocessedIdentityIds — (Array<map>)

      An array of UnprocessedIdentityId objects, each of which contains an ErrorCode and IdentityId.

      • IdentityId — (String)

        A unique identifier in the format REGION:GUID.

      • ErrorCode — (String)

        The error code indicating the type of error that occurred.

        Possible values include:
        • "AccessDenied"
        • "InternalServerError"

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE' /* required */
};
cognitoidentity.deleteIdentityPool(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityPoolId — (String)

    An identity pool ID in the format REGION:GUID.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityId: 'STRING_VALUE' /* required */
};
cognitoidentity.describeIdentity(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityId — (String)

    A unique identifier in the format REGION:GUID.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityId — (String)

      A unique identifier in the format REGION:GUID.

    • Logins — (Array<String>)

      The provider names.

    • CreationDate — (Date)

      Date on which the identity was created.

    • LastModifiedDate — (Date)

      Date on which the identity was last modified.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE' /* required */
};
cognitoidentity.describeIdentityPool(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityPoolId — (String)

    An identity pool ID in the format REGION:GUID.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityPoolId — (String)

      An identity pool ID in the format REGION:GUID.

    • IdentityPoolName — (String)

      A string that you provide.

    • AllowUnauthenticatedIdentities — (Boolean)

      TRUE if the identity pool supports unauthenticated logins.

    • AllowClassicFlow — (Boolean)

      Enables or disables the Basic (Classic) authentication flow. For more information, see Identity Pools (Federated Identities) Authentication Flow in the Amazon Cognito Developer Guide.

    • SupportedLoginProviders — (map<String>)

      Optional key:value pairs mapping provider names to provider app IDs.

    • DeveloperProviderName — (String)

      The "domain" by which Cognito will refer to your users.

    • OpenIdConnectProviderARNs — (Array<String>)

      The ARNs of the OpenID Connect providers.

    • CognitoIdentityProviders — (Array<map>)

      A list representing an Amazon Cognito user pool and its client ID.

      • ProviderName — (String)

        The provider name for an Amazon Cognito user pool. For example, cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789.

      • ClientId — (String)

        The client ID for the Amazon Cognito user pool.

      • ServerSideTokenCheck — (Boolean)

        TRUE if server-side token validation is enabled for the identity provider’s token.

        Once you set ServerSideTokenCheck to TRUE for an identity pool, that identity pool will check with the integrated user pools to make sure that the user has not been globally signed out or deleted before the identity pool provides an OIDC token or AWS credentials for the user.

        If the user is signed out or deleted, the identity pool will return a 400 Not Authorized error.

    • SamlProviderARNs — (Array<String>)

      An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.

    • IdentityPoolTags — (map<String>)

      The tags that are assigned to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityId: 'STRING_VALUE', /* required */
  CustomRoleArn: 'STRING_VALUE',
  Logins: {
    '<IdentityProviderName>': 'STRING_VALUE',
    /* '<IdentityProviderName>': ... */
  }
};
cognitoidentity.getCredentialsForIdentity(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityId — (String)

    A unique identifier in the format REGION:GUID.

  • Logins — (map<String>)

    A set of optional name-value pairs that map provider names to provider tokens. The name-value pair will follow the syntax "provider_name": "provider_user_identifier".

    Logins should not be specified when trying to get credentials for an unauthenticated identity.

    The Logins parameter is required when using identities associated with external identity providers such as Facebook. For examples of Logins maps, see the code examples in the External Identity Providers section of the Amazon Cognito Developer Guide.

  • CustomRoleArn — (String)

    The Amazon Resource Name (ARN) of the role to be assumed when multiple roles were received in the token from the identity provider. For example, a SAML-based identity provider. This parameter is optional for identity providers that do not support role customization.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityId — (String)

      A unique identifier in the format REGION:GUID.

    • Credentials — (map)

      Credentials for the provided identity ID.

      • AccessKeyId — (String)

        The Access Key portion of the credentials.

      • SecretKey — (String)

        The Secret Access Key portion of the credentials

      • SessionToken — (String)

        The Session Token portion of the credentials

      • Expiration — (Date)

        The date at which these credentials will expire.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE', /* required */
  AccountId: 'STRING_VALUE',
  Logins: {
    '<IdentityProviderName>': 'STRING_VALUE',
    /* '<IdentityProviderName>': ... */
  }
};
cognitoidentity.getId(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • AccountId — (String)

    A standard AWS account ID (9+ digits).

  • IdentityPoolId — (String)

    An identity pool ID in the format REGION:GUID.

  • Logins — (map<String>)

    A set of optional name-value pairs that map provider names to provider tokens. The available provider names for Logins are as follows:

    • Facebook: graph.facebook.com

    • Amazon Cognito user pool: cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>, for example, cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789.

    • Google: accounts.google.com

    • Amazon: www.amazon.com

    • Twitter: api.twitter.com

    • Digits: www.digits.com

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityId — (String)

      A unique identifier in the format REGION:GUID.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE' /* required */
};
cognitoidentity.getIdentityPoolRoles(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityPoolId — (String)

    An identity pool ID in the format REGION:GUID.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityPoolId — (String)

      An identity pool ID in the format REGION:GUID.

    • Roles — (map<String>)

      The map of roles associated with this pool. Currently only authenticated and unauthenticated roles are supported.

    • RoleMappings — (map<map>)

      How users for a specific identity provider are to mapped to roles. This is a String-to-RoleMapping object map. The string identifies the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id".

      • Type — required — (String)

        The role mapping type. Token will use cognito:roles and cognito:preferred_role claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.

        Possible values include:
        • "Token"
        • "Rules"
      • AmbiguousRoleResolution — (String)

        If you specify Token or Rules as the Type, AmbiguousRoleResolution is required.

        Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type.

        Possible values include:
        • "AuthenticatedRole"
        • "Deny"
      • RulesConfiguration — (map)

        The rules to be used for mapping users to roles.

        If you specify Rules as the role mapping type, RulesConfiguration is required.

        • Rules — required — (Array<map>)

          An array of rules. You can specify up to 25 rules per identity provider.

          Rules are evaluated in order. The first one to match specifies the role.

          • Claim — required — (String)

            The claim name that must be present in the token, for example, "isAdmin" or "paid".

          • MatchType — required — (String)

            The match condition that specifies how closely the claim value in the IdP token must match Value.

            Possible values include:
            • "Equals"
            • "Contains"
            • "StartsWith"
            • "NotEqual"
          • Value — required — (String)

            A brief string that the claim must match, for example, "paid" or "yes".

          • RoleARN — required — (String)

            The role ARN.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityId: 'STRING_VALUE', /* required */
  Logins: {
    '<IdentityProviderName>': 'STRING_VALUE',
    /* '<IdentityProviderName>': ... */
  }
};
cognitoidentity.getOpenIdToken(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityId — (String)

    A unique identifier in the format REGION:GUID.

  • Logins — (map<String>)

    A set of optional name-value pairs that map provider names to provider tokens. When using graph.facebook.com and www.amazon.com, supply the access_token returned from the provider's authflow. For accounts.google.com, an Amazon Cognito user pool provider, or any other OpenID Connect provider, always include the id_token.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityId — (String)

      A unique identifier in the format REGION:GUID. Note that the IdentityId returned may not match the one passed on input.

    • Token — (String)

      An OpenID token, valid for 10 minutes.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE', /* required */
  Logins: { /* required */
    '<IdentityProviderName>': 'STRING_VALUE',
    /* '<IdentityProviderName>': ... */
  },
  IdentityId: 'STRING_VALUE',
  PrincipalTags: {
    '<PrincipalTagID>': 'STRING_VALUE',
    /* '<PrincipalTagID>': ... */
  },
  TokenDuration: 'NUMBER_VALUE'
};
cognitoidentity.getOpenIdTokenForDeveloperIdentity(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityPoolId — (String)

    An identity pool ID in the format REGION:GUID.

  • IdentityId — (String)

    A unique identifier in the format REGION:GUID.

  • Logins — (map<String>)

    A set of optional name-value pairs that map provider names to provider tokens. Each name-value pair represents a user from a public provider or developer provider. If the user is from a developer provider, the name-value pair will follow the syntax "developer_provider_name": "developer_user_identifier". The developer provider is the "domain" by which Cognito will refer to your users; you provided this domain while creating/updating the identity pool. The developer user identifier is an identifier from your backend that uniquely identifies a user. When you create an identity pool, you can specify the supported logins.

  • PrincipalTags — (map<String>)

    Use this operation to configure attribute mappings for custom providers.

  • TokenDuration — (Integer)

    The expiration time of the token, in seconds. You can specify a custom expiration time for the token so that you can cache it. If you don't provide an expiration time, the token is valid for 15 minutes. You can exchange the token with Amazon STS for temporary AWS credentials, which are valid for a maximum of one hour. The maximum token duration you can set is 24 hours. You should take care in setting the expiration time for a token, as there are significant security implications: an attacker could use a leaked token to access your AWS resources for the token's duration.

    Note: Please provide for a small grace period, usually no more than 5 minutes, to account for clock skew.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityId — (String)

      A unique identifier in the format REGION:GUID.

    • Token — (String)

      An OpenID token.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE', /* required */
  IdentityProviderName: 'STRING_VALUE' /* required */
};
cognitoidentity.getPrincipalTagAttributeMap(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityPoolId — (String)

    You can use this operation to get the ID of the Identity Pool you setup attribute mappings for.

  • IdentityProviderName — (String)

    You can use this operation to get the provider name.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityPoolId — (String)

      You can use this operation to get the ID of the Identity Pool you setup attribute mappings for.

    • IdentityProviderName — (String)

      You can use this operation to get the provider name.

    • UseDefaults — (Boolean)

      You can use this operation to list

    • PrincipalTags — (map<String>)

      You can use this operation to add principal tags. The PrincipalTagsoperation enables you to reference user attributes in your IAM permissions policy.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  IdentityPoolId: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE', /* required */
  HideDisabled: true || false,
  NextToken: 'STRING_VALUE'
};
cognitoidentity.listIdentities(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • IdentityPoolId — (String)

    An identity pool ID in the format REGION:GUID.

  • MaxResults — (Integer)

    The maximum number of identities to return.

  • NextToken — (String)

    A pagination token.

  • HideDisabled — (Boolean)

    An optional boolean parameter that allows you to hide disabled identities. If omitted, the ListIdentities API will include disabled identities in the response.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityPoolId — (String)

      An identity pool ID in the format REGION:GUID.

    • Identities — (Array<map>)

      An object containing a set of identities and associated mappings.

      • IdentityId — (String)

        A unique identifier in the format REGION:GUID.

      • Logins — (Array<String>)

        The provider names.

      • CreationDate — (Date)

        Date on which the identity was created.

      • LastModifiedDate — (Date)

        Date on which the identity was last modified.

    • NextToken — (String)

      A pagination token.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  MaxResults: 'NUMBER_VALUE', /* required */
  NextToken: 'STRING_VALUE'
};
cognitoidentity.listIdentityPools(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • MaxResults — (Integer)

    The maximum number of identities to return.

  • NextToken — (String)

    A pagination token.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • IdentityPools — (Array<map>)

      The identity pools returned by the ListIdentityPools action.

      • IdentityPoolId — (String)

        An identity pool ID in the format REGION:GUID.

      • IdentityPoolName — (String)

        A string that you provide.

    • NextToken — (String)

      A pagination token.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  ResourceArn: 'STRING_VALUE' /* required */
};
cognitoidentity.listTagsForResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • ResourceArn — (String)

    The Amazon Resource Name (ARN) of the identity pool that the tags are assigned to.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Tags — (map<String>)

      The tags that are assigned to the identity pool.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.