> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# List Audit Log Entries

Returns the organization's audit log, newest first: who did what, from which channel and when. The log is read-only — there is no endpoint to create, edit or delete entries. For the list of recorded actions and what each entry stores, see the [Auditoría guide](https://docs.timbrix.mx/audit-log.md).

## Authentication

Accepts **either**:

* An API key (`X-API-Key: sk_...`) with the `read:audit-logs` scope — the organization is resolved from the key itself.
* A Supabase Bearer session (`Authorization: Bearer <token>`) with the `X-Organization-Id: <org-id>` header — the authenticated user must be an owner or admin of that organization. A member gets `403 Forbidden`.

## Query Parameters

| Parameter | Type | Required | Default | Description |
| - | - | - | - | - |
| `from` | string (ISO 8601) | No | — | Start of the range. A date-only value (`YYYY-MM-DD`) starts at 00:00 America/Mexico\_City |
| `to` | string (ISO 8601) | No | — | End of the range, inclusive. A date-only value includes the whole day in America/Mexico\_City |
| `action` | string | No | — | Comma-separated list of actions (OR-ed), e.g. `cfdi.stamped,cancellation.requested` |
| `actorUserId` | string (uuid) | No | — | Only actions done by this person |
| `actorApiKeyId` | string (uuid) | No | — | Only actions done with this API key |
| `resourceType` | string | No | — | `cfdi`, `customer`, `product`, `certificate`, `member`, `api_key`, `webhook`, `oauth_app`, `organization`, `report` or `audit_log` |
| `resourceId` | string | No | — | The resource's fiscal UUID, internal id or RFC, depending on the resource |
| `cursor` | string | No | — | The `nextCursor` value from the previous page. An invalid cursor returns `400` |
| `limit` | integer | No | `50` | Results per page (1-100) |

## Pagination

The response includes `nextCursor`. Send it as `cursor` to get the next page. When `nextCursor` is `null` there are no more results.

## Example Request

```bash theme={null}
curl "https://api.timbrix.mx/audit-logs?action=cfdi.stamped&from=2026-10-01&to=2026-10-31" \
  -H "X-API-Key: sk_..."
```

```typescript theme={null}
import { Timbrix } from "@timbrix/sdk"

const client = new Timbrix({ apiKey: "sk_..." })

const { data, nextCursor } = await client.auditLogs.list(
  "550e8400-e29b-41d4-a716-446655440000",
  { action: ["cfdi.stamped"], from: "2026-10-01", to: "2026-10-31" }
)
console.log(data, nextCursor)
```

## Example Response

```json theme={null}
{
  "data": [
    {
      "id": "0f8b2c1e-6a4d-4c43-9d6e-3b1f6a9e7c10",
      "organizationId": "550e8400-e29b-41d4-a716-446655440000",
      "seq": 1280,
      "occurredAt": "2026-10-26T05:30:00.000Z",
      "action": "cfdi.stamped",
      "result": "success",
      "actorType": "api_key",
      "actorUserId": "9b2c6f4e-1d3a-4e8b-a7c5-0f1e2d3c4b5a",
      "actorApiKeyId": "7d3a9c52-1f0e-4a8b-b6c4-2e5d8f9a1b33",
      "actorLabel": "Production API Key ...ab12",
      "resourceType": "cfdi",
      "resourceId": "3f1c9a52-7b1e-4d3a-9c0f-8a2b6e4d1c77",
      "channel": "sdk",
      "environment": "production",
      "ip": "203.0.113.10",
      "clientIp": null,
      "userAgent": "timbrix-sdk/1.12.0",
      "requestId": "5c1d7e90-3b2a-4f6e-8a1d-9e4b0c7a2d55",
      "changedFields": null,
      "metadata": { "serie": "A", "folio": "123", "total": "1160.00" }
    }
  ],
  "nextCursor": "eyJjIjoiMjAyNi0xMC0yNlQwNTozMDowMC4wMDBaIn0"
}
```

### Fields

| Field | Description |
| - | - |
| `seq` | Consecutive number of the entry within the organization. Used by [Verify](https://docs.timbrix.mx/api-reference/audit-logs/verify.md) |
| `occurredAt` | When it happened (UTC) |
| `action` | The recorded action. See the catalog in the [guide](https://docs.timbrix.mx/audit-log.md) |
| `result` | `success` or `failure` (failures are only recorded for `cfdi.stamp_failed`) |
| `actorType` | `user`, `api_key` or `system` |
| `actorUserId`, `actorApiKeyId` | Who did it. With an API key, `actorUserId` is the key's creator |
| `actorLabel` | Snapshot readable even if the person or key is later removed: email, or key name and preview |
| `resourceType`, `resourceId` | What it happened to |
| `channel` | `web`, `api`, `sdk`, `cli`, `mcp`, `cron` or `stripe` |
| `environment` | `production` or `sandbox`, when it applies |
| `ip` | IP observed by the API |
| `clientIp` | IP reported by the user's browser. Informational: it is declared by the web app and not verified |
| `requestId` | The `X-Request-Id` of the request, when there was one |
| `changedFields` | Database column names whose value changed (only in `*.updated` actions). Values are not stored |
| `metadata` | Details of the action (e.g. series, folio, total, recipient RFC). Never contains secrets; webhook URLs keep only the host and first path segment. `recordedLate.occurredAt` is set when the entry was saved after the action (automatic retry) |

## Common Errors

### 400 Bad Request

Invalid date, cursor, `resourceType` or filter value. Also returned when `X-Organization-Id` is missing on a session-authenticated request.

### 401 Unauthorized

Missing or invalid Bearer token / API key.

### 403 Forbidden

The authenticated user is not an owner or admin of the organization, or the API key does not have the `read:audit-logs` scope.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.