I am looking at the documentation of UpdateUserAttributes here: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.html.
The errors section lists CodeMismatchException and ExpiredCodeException as possible exceptions thrown by UpdateUserAttributes. I'm confused because, as far as I can tell, UpdateUserAttributes doesn't accept a verification code as an argument.
My understanding is that if I needed to verify an updated attribute like an email, that Cognito would send the verification code to the new email after UpdateUserAttributes returns successfully. I would then call VerifyUserAttribute with the verification code to verify this attribute. Understandably, VerifyUserAttribute could throw CodeMismatchException or ExpiredCodeException.
This leads me to the question in the title: given that UpdateUserAttributes doesn't handle verification codes, under what circumstances could UpdateUserAttributes throw CodeMismatchException or ExpiredCodeException? Am I misunderstanding something fundamental about how UpdateUserAttributes works?