{ "description": "Defines the payload expected by `amplify update auth --headless`", "type": "object", "properties": { "version": { "type": "number", "enum": [1] }, "serviceModification": { "anyOf": [ { "allOf": [ { "$ref": "#/definitions/BaseCognitoServiceModification" }, { "$ref": "#/definitions/NoCognitoIdentityPool" } ] }, { "allOf": [ { "$ref": "#/definitions/BaseCognitoServiceModification" }, { "$ref": "#/definitions/ModifyCognitoIdentityPool" } ] } ] } }, "required": ["serviceModification", "version"], "definitions": { "BaseCognitoServiceModification": { "type": "object", "properties": { "serviceName": { "type": "string", "enum": ["Cognito"] }, "userPoolModification": { "description": "A subset of properties from CognitoUserPoolConfiguration that can be modified.\n\nEach field will overwrite the entire previous configuration of that field, but omitted fields will not be removed.\nFor example, adding auth with\n\n{\n readAttributes: ['EMAIL', 'NAME', 'PHONE_NUMBER'],\n passwordPolicy: {\n minimumLength: 10,\n additionalConstraints: [\n REQUIRE_LOWERCASE, REQUIRE_UPPERCASE\n ]\n }\n}\n\nand then updating auth with\n\n{\n passwordPolicy: {\n minimumLength: 8\n }\n}\n\nwill overwrite the entire passwordPolicy (removing the lowercase and uppercase constraints)\nbut will leave the readAttributes unaffected.\n\nHowever, the oAuth field is treated slightly differently:\n Omitting the oAuth field entirely will leave oAuth configuration unchanged.\n Setting oAuth to {} (an empty object) will remove oAuth from the auth resource.\n Including a non-empty oAuth configuration will overwrite the previous oAuth configuration.", "allOf": [ { "$ref": "#/definitions/Pick" }, { "type": "object", "properties": { "oAuth": { "$ref": "#/definitions/Partial" } } } ] } }, "required": ["serviceName", "userPoolModification"] }, "Pick": { "type": "object", "properties": { "userPoolGroups": { "description": "User pool groups to create within the user pool. If not specified, no groups are created.", "type": "array", "items": { "$ref": "#/definitions/CognitoUserPoolGroup" } }, "adminQueries": { "$ref": "#/definitions/CognitoAdminQueries", "description": "If defined, an Admin Queries API is created." }, "mfa": { "description": "If defined, specifies MFA configuration. Default is MFA off.", "anyOf": [ { "$ref": "#/definitions/CognitoMFAOff" }, { "$ref": "#/definitions/CognitoMFASettings" } ] }, "passwordPolicy": { "$ref": "#/definitions/CognitoPasswordPolicy", "description": "If defined, specifies password constraint configuration. Default is minimum length of 8 characters." }, "passwordRecovery": { "description": "DEPRECATED. Use autoVerifiedAttributes in headless schema version 2 instead. If defined, specifies password recovery configuration. Default is email recovery.", "anyOf": [ { "$ref": "#/definitions/CognitoEmailPasswordRecoveryConfiguration" }, { "$ref": "#/definitions/CognitoSMSPasswordRecoveryConfiguration" } ] }, "refreshTokenPeriod": { "description": "Defines how long refresh tokens are valid in days. Default is 30 days.", "type": "number" }, "readAttributes": { "description": "Defines which user attributes can be read by the app. Default is email.", "type": "array", "items": { "enum": [ "ADDRESS", "BIRTHDATE", "EMAIL", "EMAIL_VERIFIED", "FAMILY_NAME", "GENDER", "GIVEN_NAME", "LOCALE", "MIDDLE_NAME", "NAME", "NICKNAME", "PHONE_NUMBER", "PHONE_NUMBER_VERIFIED", "PICTURE", "PREFERRED_USERNAME", "PROFILE", "UPDATED_AT", "WEBSITE", "ZONE_INFO" ], "type": "string" } }, "writeAttributes": { "description": "Defines which user attributes can be written by the app. Default is none.", "type": "array", "items": { "enum": [ "ADDRESS", "BIRTHDATE", "EMAIL", "FAMILY_NAME", "GENDER", "GIVEN_NAME", "LOCALE", "MIDDLE_NAME", "NAME", "NICKNAME", "PHONE_NUMBER", "PICTURE", "PREFERRED_USERNAME", "PROFILE", "UPDATED_AT", "WEBSITE", "ZONE_INFO" ], "type": "string" } } } }, "CognitoUserPoolGroup": { "description": "Defines a Cognito user pool group.", "type": "object", "properties": { "customPolicy": { "description": "Not implemented and should not be used.", "type": "string" }, "groupName": { "description": "The group name.", "type": "string" } }, "required": ["groupName"] }, "CognitoAdminQueries": { "description": "Configuration for the AdminQueries API", "type": "object", "properties": { "permissions": { "description": "Defines the API permissions. groupName must only be specified if restrictAccess is true, in which case only the specified user pool group will have access to the Admin Queries API.", "type": "object", "properties": { "restrictAccess": { "type": "boolean" }, "groupName": { "type": "string" } }, "required": ["restrictAccess"] } }, "required": ["permissions"] }, "CognitoMFAOff": { "description": "Specifies that MFA should not be enabled for the user pool.", "type": "object", "properties": { "mode": { "type": "string", "enum": ["OFF"] } }, "required": ["mode"] }, "CognitoMFASettings": { "description": "Specifies that MFA is enabled for the user pool.", "type": "object", "properties": { "mode": { "description": "ON requires users to set up MFA when creating an account. OPTIONAL means the user has the option to set up MFA.", "enum": ["ON", "OPTIONAL"], "type": "string" }, "mfaTypes": { "description": "MFA delivery options.", "type": "array", "items": { "enum": ["SMS", "TOTP"], "type": "string" } }, "smsMessage": { "description": "If SMS is specified in \"mfaTypes\" this specifies the smsMessage that will be sent to the user.", "type": "string" } }, "required": ["mfaTypes", "mode", "smsMessage"] }, "CognitoPasswordPolicy": { "type": "object", "properties": { "minimumLength": { "type": "number" }, "additionalConstraints": { "type": "array", "items": { "description": "Password contraints that can be applied to Cognito user pools.", "enum": ["REQUIRE_DIGIT", "REQUIRE_LOWERCASE", "REQUIRE_SYMBOL", "REQUIRE_UPPERCASE"], "type": "string" } } } }, "CognitoEmailPasswordRecoveryConfiguration": { "description": "Defines the email that will be sent to users to recover their password.", "type": "object", "properties": { "deliveryMethod": { "type": "string", "enum": ["EMAIL"] }, "emailMessage": { "type": "string" }, "emailSubject": { "type": "string" } }, "required": ["deliveryMethod", "emailMessage", "emailSubject"] }, "CognitoSMSPasswordRecoveryConfiguration": { "description": "Defines the SMS message that will be send to users to recover their password", "type": "object", "properties": { "deliveryMethod": { "type": "string", "enum": ["SMS"] }, "smsMessage": { "type": "string" } }, "required": ["deliveryMethod", "smsMessage"] }, "Partial": { "description": "Make all properties in T optional", "type": "object", "properties": { "domainPrefix": { "description": "Your hosted UI domain name.", "type": "string" }, "redirectSigninURIs": { "description": "Valid signin redirect URIs.", "type": "array", "items": { "type": "string" } }, "redirectSignoutURIs": { "description": "Valid signout redirect URIs.", "type": "array", "items": { "type": "string" } }, "oAuthGrantType": { "description": "The oAuth grant type.", "enum": ["CODE", "IMPLICIT"], "type": "string" }, "oAuthScopes": { "description": "The oAuth scopes granted by signin.", "type": "array", "items": { "enum": ["AWS.COGNITO.SIGNIN.USER.ADMIN", "EMAIL", "OPENID", "PHONE", "PROFILE"], "type": "string" } }, "socialProviderConfigurations": { "description": "If defined, users will be able to login with the specified social providers.", "type": "array", "items": { "anyOf": [ { "$ref": "#/definitions/SocialProviderConfig" }, { "$ref": "#/definitions/SignInWithAppleSocialProviderConfig" } ] } } } }, "SocialProviderConfig": { "description": "Defines a Cognito oAuth social provider", "type": "object", "properties": { "provider": { "description": "Social providers supported by Amplify and Cognito", "enum": ["FACEBOOK", "GOOGLE", "LOGIN_WITH_AMAZON"], "type": "string" }, "clientId": { "description": "The client ID (sometimes called app ID) configured with the provider.", "type": "string" }, "clientSecret": { "description": "The client secret (sometimes called an app secret) configured with the provider.", "type": "string" } }, "required": ["clientId", "clientSecret", "provider"] }, "SignInWithAppleSocialProviderConfig": { "description": "Defines a Cognito Sign in with Apple oAuth social provider", "type": "object", "properties": { "provider": { "type": "string", "enum": ["SIGN_IN_WITH_APPLE"] }, "clientId": { "description": "The client ID (sometimes called apple services ID) configured with the provider.", "type": "string" }, "teamId": { "description": "The team ID configured with the provider", "type": "string" }, "keyId": { "description": "The key ID (sometimes called apple private key ID) configured with the provider.", "type": "string" }, "privateKey": { "description": "The private key configured with the provider. Value can be undefined on an update request.\nEvery member can be updated except the privateKey because the privateKey isn't easily retrievable.", "type": "string" } }, "required": ["clientId", "keyId", "provider", "teamId"] }, "NoCognitoIdentityPool": { "description": "Specifies that the Cognito configuration should not include an identity pool.", "type": "object", "properties": { "includeIdentityPool": { "description": "Indicates an indentity pool should not be configured.", "type": "boolean", "enum": [false] } }, "required": ["includeIdentityPool"] }, "ModifyCognitoIdentityPool": { "type": "object", "properties": { "includeIdentityPool": { "type": "boolean", "enum": [true] }, "identityPoolModification": { "$ref": "#/definitions/Pick" } }, "required": ["identityPoolModification", "includeIdentityPool"] }, "Pick": { "type": "object", "properties": { "unauthenticatedLogin": { "description": "Allow guest login or not. Default is false.", "type": "boolean" }, "identitySocialFederation": { "description": "If specified, Cognito will allow the specified providers to federate into the IdentityPool.", "type": "array", "items": { "$ref": "#/definitions/CognitoIdentitySocialFederation" } } } }, "CognitoIdentitySocialFederation": { "description": "Defines a social federation provider.", "type": "object", "properties": { "provider": { "enum": ["AMAZON", "APPLE", "FACEBOOK", "GOOGLE"], "type": "string" }, "clientId": { "description": "ClientId unique to your client and the provider.", "type": "string" } }, "required": ["clientId", "provider"] } }, "$schema": "http://json-schema.org/draft-07/schema#" }