Skip to main content
POST

Body

application/json

Which field carries the answer depends on challenge. Sending the wrong one — or leaving it out — is a 400 before the request ever reaches Cognito.

​
challenge
enum<string>
required

Copy the challenge value from the response you are answering.

Available options:
SMS_MFA,
NEW_PASSWORD_REQUIRED
Example:

"SMS_MFA"

​
session
string
required

The session from that same response, unchanged.

Example:

"AYABeF7x..."

​
email
string<email>
required

The same email that was signed in with. The session alone does not identify the user to Cognito.

Example:

"you@company.com"

​
code
string

SMS_MFA only. The code from the text message.

Send it as a string, always. Codes can begin with a zero, and "012345" arriving as the JSON number 12345 is a different code — which is why a number here is rejected outright instead of being coerced into an intermittent "wrong code" for one user in ten.

Example:

"123456"

​
new_password
string<password>

NEW_PASSWORD_REQUIRED only. The password the user chose. It has to satisfy the account's password policy — if it does not, the call comes back 400 InvalidPasswordException and the user needs to pick another one. Retry with the same session; if that is refused too, the attempt is spent and the way back is /v1/signin.

Example:

"••••••••"

Response

Either a token, or the next challenge in the chain.

Sign-in completed.

​
id_token
string
required

Send THIS one as Authorization: Bearer <id_token>. It carries the identity the APIs authorize on — your email and the accounts your credentials cover. The access token does not.

Example:

"eyJraWQiOiJhYmMxMjMiLCJhbGciOiJSUzI1NiJ9..."

​
access_token
string
required

Issued by Cognito alongside the id token. Not what the Cloud Humans APIs read.

Example:

"eyJraWQiOiJkZWY0NTYiLCJhbGciOiJSUzI1NiJ9..."

​
expires_in
integer
required

Lifetime in seconds.

Example:

3600

​
token_type
string
required

Always Bearer.

Example:

"Bearer"