diff --git a/amazon/cognito/client/src/main/kotlin/org/http4k/connect/amazon/cognito/action/InitiateAuth.kt b/amazon/cognito/client/src/main/kotlin/org/http4k/connect/amazon/cognito/action/InitiateAuth.kt
index a6a7de660..c145f0b21 100644
--- a/amazon/cognito/client/src/main/kotlin/org/http4k/connect/amazon/cognito/action/InitiateAuth.kt
+++ b/amazon/cognito/client/src/main/kotlin/org/http4k/connect/amazon/cognito/action/InitiateAuth.kt
@@ -25,7 +25,7 @@ data class InitiateAuth(
 @JsonSerializable
 data class AuthInitiated(
     val AuthenticationResult: AuthenticationResult,
-    val ChallengeName: ChallengeName,
+    val ChallengeName: ChallengeName?,
     val ChallengeParameters: Map<String, String>,
-    val Session: Session
+    val Session: Session?
 )
diff --git a/amazon/cognito/client/src/test/kotlin/org/http4k/connect/amazon/cognito/ActualCognitoResponsesTest.kt b/amazon/cognito/client/src/test/kotlin/org/http4k/connect/amazon/cognito/ActualCognitoResponsesTest.kt
new file mode 100644
index 000000000..b2eb5dade
--- /dev/null
+++ b/amazon/cognito/client/src/test/kotlin/org/http4k/connect/amazon/cognito/ActualCognitoResponsesTest.kt
@@ -0,0 +1,32 @@
+package org.http4k.connect.amazon.cognito
+
+import com.natpryce.hamkrest.assertion.assertThat
+import com.natpryce.hamkrest.equalTo
+import org.http4k.connect.amazon.cognito.action.AuthInitiated
+import org.http4k.connect.amazon.cognito.model.AccessToken
+import org.http4k.connect.amazon.cognito.model.IdToken
+import org.http4k.connect.amazon.cognito.model.RefreshToken
+import org.junit.jupiter.api.Test
+
+class ActualCognitoResponsesTest {
+
+    val factory = CognitoMoshi
+
+    @Test
+    fun `deserialising a user password response with no challenges requested`() {
+        val response = factory.asA<AuthInitiated>("""{"AuthenticationResult":
+            {"AccessToken":"access-token",
+            "ExpiresIn":3600,
+            "IdToken":"id-token",
+            "RefreshToken":"refresh-token",
+            "TokenType":"Bearer"},
+            "ChallengeParameters":{}}
+        """.trimIndent())
+        assertThat(response.AuthenticationResult.AccessToken, equalTo(AccessToken.of("access-token")))
+        assertThat(response.AuthenticationResult.ExpiresIn, equalTo(3600))
+        assertThat(response.AuthenticationResult.IdToken, equalTo(IdToken.of("id-token")))
+        assertThat(response.AuthenticationResult.RefreshToken, equalTo(RefreshToken.of("refresh-token")))
+        assertThat(response.AuthenticationResult.TokenType, equalTo("Bearer"))
+        assertThat(response.ChallengeParameters, equalTo(mapOf()))
+    }
+}