Skip to content
AWS for Query.Farm

aws.cognito_idp.describe_user_pool_client

Example SQL Queries

SELECT * FROM
aws.cognito_idp.describe_user_pool_client
WHERE
"user_pool_id" = 'VALUE'
AND "client_id" = 'VALUE';

Description

Client method for returning the configuration information and metadata of the specified user pool app client.

Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy.

Learn more

Table Definition

Column NameColumn Data Type
client_id Required Input Column

The app client ID of the app associated with the user pool.

VARCHAR
user_pool_id Required Input Column

The user pool ID for the user pool you want to describe.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
user_pool_client

The user pool client from a server response to describe the user pool client.

STRUCT(
    "user_pool_id" VARCHAR,
    "client_name" VARCHAR,
    "client_id" VARCHAR,
    "client_secret" VARCHAR,
    "last_modified_date" TIMESTAMP_S,
    "creation_date" TIMESTAMP_S,
    "refresh_token_validity" BIGINT,
    "access_token_validity" BIGINT,
    "id_token_validity" BIGINT,
    "token_validity_units" STRUCT(
        "access_token" VARCHAR,
        "id_token" VARCHAR,
        "refresh_token" VARCHAR
    ),
    "read_attributes" VARCHAR[],
    "write_attributes" VARCHAR[],
    "explicit_auth_flows" VARCHAR[],
    "supported_identity_providers" VARCHAR[],
    "callback_ur_ls" VARCHAR[],
    "logout_ur_ls" VARCHAR[],
    "default_redirect_uri" VARCHAR,
    "allowed_o_auth_flows" VARCHAR[],
    "allowed_o_auth_scopes" VARCHAR[],
    "allowed_o_auth_flows_user_pool_client" BOOLEAN,
    "analytics_configuration" STRUCT(
        "application_id" VARCHAR,
        "application_arn" VARCHAR,
        "role_arn" VARCHAR,
        "external_id" VARCHAR,
        "user_data_shared" BOOLEAN
    ),
    "prevent_user_existence_errors" VARCHAR,
    "enable_token_revocation" BOOLEAN,
    "enable_propagate_additional_user_context_data" BOOLEAN,
    "auth_session_validity" BIGINT
)
Show child fields
user_pool_client.access_token_validity

The access token time limit. After this limit expires, your user can't use their access token. To specify the time unit for AccessTokenValidity as seconds, minutes, hours, or days, set a TokenValidityUnits value in your API request.

For example, when you set AccessTokenValidity to 10 and TokenValidityUnits to hours, your user can authorize access with their access token for 10 hours.

The default time unit for AccessTokenValidity in an API request is hours. Valid range is displayed below in seconds.

If you don't specify otherwise in the configuration of your app client, your access tokens are valid for one hour.

user_pool_client.allowed_o_auth_flows[]
user_pool_client.allowed_o_auth_flows_user_pool_client

Set to true to use OAuth 2.0 features in your user pool app client.

AllowedOAuthFlowsUserPoolClient must be true before you can configure the following features in your app client.

  • CallBackURLs: Callback URLs.

  • LogoutURLs: Sign-out redirect URLs.

  • AllowedOAuthScopes: OAuth 2.0 scopes.

  • AllowedOAuthFlows: Support for authorization code, implicit, and client credentials OAuth 2.0 grants.

To use OAuth 2.0 features, configure one of these features in the Amazon Cognito console or set AllowedOAuthFlowsUserPoolClient to true in a CreateUserPoolClient or UpdateUserPoolClient API request. If you don't set a value for AllowedOAuthFlowsUserPoolClient in a request with the CLI or SDKs, it defaults to false.

user_pool_client.allowed_o_auth_scopes[]
user_pool_client.analytics_configuration

The Amazon Pinpoint analytics configuration for the user pool client.

Amazon Cognito user pools only support sending events to Amazon Pinpoint projects in the US East (N. Virginia) us-east-1 Region, regardless of the Region where the user pool resides.

Show child fields
user_pool_client.analytics_configuration.application_arn

The Amazon Resource Name (ARN) of an Amazon Pinpoint project. You can use the Amazon Pinpoint project to integrate with the chosen user pool Client. Amazon Cognito publishes events to the Amazon Pinpoint project that the app ARN declares.

user_pool_client.analytics_configuration.application_id

The application ID for an Amazon Pinpoint application.

user_pool_client.analytics_configuration.external_id

The external ID.

user_pool_client.analytics_configuration.role_arn

The ARN of an Identity and Access Management role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics.

user_pool_client.analytics_configuration.user_data_shared

If UserDataShared is true, Amazon Cognito includes user data in the events that it publishes to Amazon Pinpoint analytics.

user_pool_client.auth_session_validity

Amazon Cognito creates a session token for each API request in an authentication flow. AuthSessionValidity is the duration, in minutes, of that session token. Your user pool native user must respond to each authentication challenge before the session expires.

user_pool_client.callback_ur_ls[]
user_pool_client.client_id

The ID of the client associated with the user pool.

user_pool_client.client_name

The client name from the user pool request of the client type.

user_pool_client.client_secret

The client secret from the user pool request of the client type.

user_pool_client.creation_date

The date and time when the item was created. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a human-readable format like ISO 8601 or a Java Date object.

user_pool_client.default_redirect_uri

The default redirect URI. Must be in the CallbackURLs list.

A redirect URI must:

  • Be an absolute URI.

  • Be registered with the authorization server.

  • Not include a fragment component.

See OAuth 2.0 - Redirection Endpoint.

Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes only.

App callback URLs such as myapp://example are also supported.

user_pool_client.enable_propagate_additional_user_context_data

When EnablePropagateAdditionalUserContextData is true, Amazon Cognito accepts an IpAddress value that you send in the UserContextData parameter. The UserContextData parameter sends information to Amazon Cognito advanced security for risk analysis. You can send UserContextData when you sign in Amazon Cognito native users with the InitiateAuth and RespondToAuthChallenge API operations.

When EnablePropagateAdditionalUserContextData is false, you can't send your user's source IP address to Amazon Cognito advanced security with unauthenticated API operations. EnablePropagateAdditionalUserContextData doesn't affect whether you can send a source IP address in a ContextData parameter with the authenticated API operations AdminInitiateAuth and AdminRespondToAuthChallenge.

You can only activate EnablePropagateAdditionalUserContextData in an app client that has a client secret. For more information about propagation of user context data, see Adding user device and session data to API requests.

user_pool_client.enable_token_revocation

Indicates whether token revocation is activated for the user pool client. When you create a new user pool client, token revocation is activated by default. For more information about revoking tokens, see RevokeToken.

user_pool_client.explicit_auth_flows[]
user_pool_client.id_token_validity

The ID token time limit. After this limit expires, your user can't use their ID token. To specify the time unit for IdTokenValidity as seconds, minutes, hours, or days, set a TokenValidityUnits value in your API request.

For example, when you set IdTokenValidity as 10 and TokenValidityUnits as hours, your user can authenticate their session with their ID token for 10 hours.

The default time unit for IdTokenValidity in an API request is hours. Valid range is displayed below in seconds.

If you don't specify otherwise in the configuration of your app client, your ID tokens are valid for one hour.

user_pool_client.last_modified_date

The date and time when the item was modified. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a human-readable format like ISO 8601 or a Java Date object.

user_pool_client.logout_ur_ls[]
user_pool_client.prevent_user_existence_errors

Errors and responses that you want Amazon Cognito APIs to return during authentication, account confirmation, and password recovery when the user doesn't exist in the user pool. When set to ENABLED and the user doesn't exist, authentication returns an error indicating either the username or password was incorrect. Account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to LEGACY, those APIs return a UserNotFoundException exception if the user doesn't exist in the user pool.

Valid values include:

  • ENABLED - This prevents user existence-related errors.

  • LEGACY - This represents the early behavior of Amazon Cognito where user existence related errors aren't prevented.

Defaults to LEGACY when you don't provide a value.

user_pool_client.read_attributes[]
user_pool_client.refresh_token_validity

The refresh token time limit. After this limit expires, your user can't use their refresh token. To specify the time unit for RefreshTokenValidity as seconds, minutes, hours, or days, set a TokenValidityUnits value in your API request.

For example, when you set RefreshTokenValidity as 10 and TokenValidityUnits as days, your user can refresh their session and retrieve new access and ID tokens for 10 days.

The default time unit for RefreshTokenValidity in an API request is days. You can't set RefreshTokenValidity to 0. If you do, Amazon Cognito overrides the value with the default value of 30 days. Valid range is displayed below in seconds.

If you don't specify otherwise in the configuration of your app client, your refresh tokens are valid for 30 days.

user_pool_client.supported_identity_providers[]
user_pool_client.token_validity_units

The time units used to specify the token validity times of each token type: ID, access, and refresh.

Show child fields
user_pool_client.token_validity_units.access_token

A time unit of seconds, minutes, hours, or days for the value that you set in the AccessTokenValidity parameter. The default AccessTokenValidity time unit is hours. AccessTokenValidity duration can range from five minutes to one day.

user_pool_client.token_validity_units.id_token

A time unit of seconds, minutes, hours, or days for the value that you set in the IdTokenValidity parameter. The default IdTokenValidity time unit is hours. IdTokenValidity duration can range from five minutes to one day.

user_pool_client.token_validity_units.refresh_token

A time unit of seconds, minutes, hours, or days for the value that you set in the RefreshTokenValidity parameter. The default RefreshTokenValidity time unit is days. RefreshTokenValidity duration can range from 60 minutes to 10 years.

user_pool_client.user_pool_id

The user pool ID for the user pool client.

user_pool_client.write_attributes[]