List Audit Log Entries

Returns the organization’s audit log, newest first: who did what, from which channel and when. The log is read-only — there is no endpoint to create, edit or delete entries. For the list of recorded actions and what each entry stores, see the Auditoría guide.

Authentication

Accepts either:

An API key (X-API-Key: sk_...) with the read:audit-logs scope — the organization is resolved from the key itself.
A Supabase Bearer session (Authorization: Bearer <token>) with the X-Organization-Id: <org-id> header — the authenticated user must be an owner or admin of that organization. A member gets 403 Forbidden.

Query Parameters

Parameter	Type	Required	Default	Description
`from`	string (ISO 8601)	No	—	Start of the range. A date-only value (`YYYY-MM-DD`) starts at 00:00 America/Mexico_City
`to`	string (ISO 8601)	No	—	End of the range, inclusive. A date-only value includes the whole day in America/Mexico_City
`action`	string	No	—	Comma-separated list of actions (OR-ed), e.g. `cfdi.stamped,cancellation.requested`
`actorUserId`	string (uuid)	No	—	Only actions done by this person
`actorApiKeyId`	string (uuid)	No	—	Only actions done with this API key
`resourceType`	string	No	—	`cfdi`, `customer`, `product`, `certificate`, `member`, `api_key`, `webhook`, `oauth_app`, `organization`, `report` or `audit_log`
`resourceId`	string	No	—	The resource’s fiscal UUID, internal id or RFC, depending on the resource
`cursor`	string	No	—	The `nextCursor` value from the previous page. An invalid cursor returns `400`
`limit`	integer	No	`50`	Results per page (1-100)

Pagination

The response includes nextCursor. Send it as cursor to get the next page. When nextCursor is null there are no more results.

Example Request

curl "https://api.timbrix.mx/audit-logs?action=cfdi.stamped&from=2026-10-01&to=2026-10-31" \
  -H "X-API-Key: sk_..."

import { Timbrix } from "@timbrix/sdk"

const client = new Timbrix({ apiKey: "sk_..." })

const { data, nextCursor } = await client.auditLogs.list(
  "550e8400-e29b-41d4-a716-446655440000",
  { action: ["cfdi.stamped"], from: "2026-10-01", to: "2026-10-31" }
)
console.log(data, nextCursor)

Example Response

{
  "data": [
    {
      "id": "0f8b2c1e-6a4d-4c43-9d6e-3b1f6a9e7c10",
      "organizationId": "550e8400-e29b-41d4-a716-446655440000",
      "seq": 1280,
      "occurredAt": "2026-10-26T05:30:00.000Z",
      "action": "cfdi.stamped",
      "result": "success",
      "actorType": "api_key",
      "actorUserId": "9b2c6f4e-1d3a-4e8b-a7c5-0f1e2d3c4b5a",
      "actorApiKeyId": "7d3a9c52-1f0e-4a8b-b6c4-2e5d8f9a1b33",
      "actorLabel": "Production API Key ...ab12",
      "resourceType": "cfdi",
      "resourceId": "3f1c9a52-7b1e-4d3a-9c0f-8a2b6e4d1c77",
      "channel": "sdk",
      "environment": "production",
      "ip": "203.0.113.10",
      "clientIp": null,
      "userAgent": "timbrix-sdk/1.12.0",
      "requestId": "5c1d7e90-3b2a-4f6e-8a1d-9e4b0c7a2d55",
      "changedFields": null,
      "metadata": { "serie": "A", "folio": "123", "total": "1160.00" }
    }
  ],
  "nextCursor": "eyJjIjoiMjAyNi0xMC0yNlQwNTozMDowMC4wMDBaIn0"
}

Fields

Field	Description
`seq`	Consecutive number of the entry within the organization. Used by Verify
`occurredAt`	When it happened (UTC)
`action`	The recorded action. See the catalog in the guide
`result`	`success` or `failure` (failures are only recorded for `cfdi.stamp_failed`)
`actorType`	`user`, `api_key` or `system`
`actorUserId`, `actorApiKeyId`	Who did it. With an API key, `actorUserId` is the key’s creator
`actorLabel`	Snapshot readable even if the person or key is later removed: email, or key name and preview
`resourceType`, `resourceId`	What it happened to
`channel`	`web`, `api`, `sdk`, `cli`, `mcp`, `cron` or `stripe`
`environment`	`production` or `sandbox`, when it applies
`ip`	IP observed by the API
`clientIp`	IP reported by the user’s browser. Informational: it is declared by the web app and not verified
`requestId`	The `X-Request-Id` of the request, when there was one
`changedFields`	Database column names whose value changed (only in `*.updated` actions). Values are not stored
`metadata`	Details of the action (e.g. series, folio, total, recipient RFC). Never contains secrets; webhook URLs keep only the host and first path segment. `recordedLate.occurredAt` is set when the entry was saved after the action (automatic retry)

Common Errors

400 Bad Request

Invalid date, cursor, resourceType or filter value. Also returned when X-Organization-Id is missing on a session-authenticated request.

401 Unauthorized

Missing or invalid Bearer token / API key.

403 Forbidden

The authenticated user is not an owner or admin of the organization, or the API key does not have the read:audit-logs scope.

​Authentication

​Query Parameters

​Pagination

​Example Request

​Example Response

​Fields

​Common Errors

​400 Bad Request

​401 Unauthorized

​403 Forbidden