AWS Amazon Cognito Error Codes

This exception is thrown when you don't have sufficient permissions to perform the requested operation.

This exception is thrown when a user tries to confirm the account with an email address or phone number that has already been supplied as an alias for a different user profile. This exception indicates that an account with this email address or phone already exists in a user pool that you've configured to use email address or phone number as a sign-in alias.

This exception is thrown when a verification code fails to deliver successfully.

This exception is thrown if the provided code doesn't match what the server was expecting.

This exception is thrown if two or more modifications are happening concurrently.

This exception is thrown when a user attempts to confirm a device with a device key that already exists.

This exception is thrown when the provider is already supported by the user pool.

This exception is thrown when there is a code mismatch and the service fails to configure the software token TOTP multi-factor authentication (MFA).

This exception is thrown if a code has expired.

This exception is thrown when a feature you attempted to configure isn't available in your current feature plan.

This exception is thrown when WAF doesn't allow your request based on a web ACL that's associated with your user pool.

This exception is thrown when Amazon Cognito encounters a group that already exists in the user pool.

This exception is thrown when Amazon Cognito encounters an internal error.

This exception is thrown when Amazon Cognito encounters an internal server error.

This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.

This exception is thrown when Amazon Cognito encounters an invalid Lambda response.

This exception is thrown when the specified OAuth flow is not valid.

This exception is thrown when the Amazon Cognito service encounters an invalid parameter.

This exception is thrown when Amazon Cognito encounters an invalid password.

This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.

This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust cognito-idp.amazonaws.com or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.

This exception is thrown when the user pool configuration is not valid.

This exception is thrown when a user exceeds the limit for a requested Amazon Web Services resource.

This exception is thrown when you attempt to apply a managed login branding style to an app client that already has an assigned style.

This exception is thrown when Amazon Cognito can't find a multi-factor authentication (MFA) method.

This exception is thrown when a user isn't authorized.

The message returned when a user's new password matches a previous password and doesn't comply with the password-history policy.

This exception is thrown when a password reset is required.

This exception is thrown when a precondition is not met.

This exception is throw when your application requests token refresh with a refresh token that has been invalidated by refresh-token rotation.

This exception is thrown when the Amazon Cognito service can't find the requested resource.

This exception is thrown when the specified scope doesn't exist.

This exception is thrown when the software token time-based one-time password (TOTP) multi-factor authentication (MFA) isn't activated for the user pool.

Terms document names must be unique to the app client. This exception is thrown when you attempt to create terms documents with a duplicate TermsName.

This exception is thrown when you've attempted to change your feature plan but the operation isn't permitted.

This exception is thrown when the user has made too many failed attempts for a given action, such as sign-in.

This exception is thrown when the user has made too many requests for a given operation.

Exception that is thrown when the request isn't authorized. This can happen due to an invalid access token in the request.

This exception is thrown when Amazon Cognito encounters an unexpected exception with Lambda.

This exception is thrown when the specified identifier isn't supported.

Exception that is thrown when you attempt to perform an operation that isn't enabled for the user pool client.

Exception that is thrown when an unsupported token is passed to an operation.

The request failed because the user is in an unsupported state.

This exception is thrown when you're trying to modify a user pool while a user import job is in progress for that pool.

This exception is thrown when the Amazon Cognito service encounters a user validation exception with the Lambda service.

This exception is thrown when Amazon Cognito encounters a user name that already exists in the user pool.

This exception is thrown when a user isn't confirmed successfully.

This exception is thrown when a user isn't found.

This exception is thrown when user pool add-ons aren't enabled.

This exception is thrown when a user pool tag can't be set or updated.

This exception is thrown when the challenge from StartWebAuthn registration has expired.

This exception is thrown when the access token is for a different client than the one in the original StartWebAuthnRegistration request.

This exception is thrown when a user pool doesn't have a configured relying party id or a user pool domain.

This exception is thrown when a user presents passkey credentials from an unsupported device or provider.

This exception is thrown when the passkey feature isn't enabled for the user pool.

This exception is thrown when the passkey credential's registration origin does not align with the user pool relying party id.

This exception is thrown when the given passkey credential is associated with a different relying party ID than the user pool relying party ID.