stuntstunt
← all adapters

aws-cognito-style

simulates Amazon Cognito Identity Provider API 2016-04-18

restadapter v0.2.07 routes

verification

VMVM tier — no SDK suite yet· surface 7 · not implemented 6 · differs 3

use it

# add to stunt.yaml
services:
  aws-cognito:
    adapter: embedded:aws-cognito-style

# then
$ stunt up

The embedded: source extracts this adapter from the binary — no git clone, fully offline.

how to mock the Amazon Cognito Identity Provider API locally

Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of Amazon Cognito Identity Provider API. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real Amazon Cognito Identity Provider API 2016-04-18 surface — the data is fake, the behavior is real.

backing stores

userstokensoauth_codes

api surface (7)

generated from the adapter manifest — exactly what boots, nothing more

7 routes
GET/oauth2/authorize
POST/oauth2/token
GET/oauth2/userInfo
GET/login
GET/logout
POST/
GET/{userPoolId}/.well-known/jwks.json

VM-verified behaviors (7)

  • ✓a reset code older than one hour answers ExpiredCodeException
  • ✓a NEW_PASSWORD_REQUIRED session works until AuthSessionValidity lapses
  • ✓past the session window the challenge answer is NotAuthorizedException
  • ✓refresh tokens are reusable without rotation; access tokens rotate
  • ✓the refresh token dies at its 30-day expiry with invalid_grant
  • ✓two authorize flows bind the same seeded demo-user
  • ✓authorize never mints new users into the collection

Not implemented (6)

  • No USER_SRP_AUTH — only USER_PASSWORD_AUTH and admin flows
  • No AdminGetUser, AdminDeleteUser, or attribute-update operations
  • No groups, custom auth challenges, or lambda triggers
  • No ResendConfirmationCode or ChangePassword operations
  • No GetOpenIdToken or developer-authenticated identity flows
  • No hosted-UI OIDC discovery or /oauth2/revoke endpoints

Differs from the real API (3)

  • Service API SigV4 is structure-checked only — signature not cryptographically enforced
  • Verification/reset codes are the last 6 digits of the username, zero-padded
  • Hosted UI has no login page — authorize auto-binds login_hint user or seeded demo-user
full scorecard →
want more of the Amazon Cognito Identity Provider API surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.