> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# Download the stamped CFDI XML

> Authenticate with either a Supabase session (member of the invoice's organization) or an API key belonging to that same organization. Streams back the exact XML returned by the PAC at stamping time, as stored in `invoices.xml`.



## OpenAPI

````yaml https://api.timbrix.mx/api/openapi.json get /invoices/{uuid}/xml
openapi: 3.0.0
info:
  title: Timbrix API
  description: >-
    API de facturación electrónica CFDI 4.0 para México, con servidor OAuth2
    para gestionar organizaciones, miembros y webhooks. Compatible con agentes
    de IA — ver la extensión `x-ai-agent-friendly` en la raíz de esta spec.


    REST API with OAuth2 server for managing organizations, members, and
    webhooks.
  version: '1.0'
  contact: {}
servers: []
security: []
tags:
  - name: organizations
    description: Organization management endpoints
  - name: oauth
    description: OAuth2 authentication and authorization
  - name: webhooks
    description: Webhook configuration and delivery
  - name: users
    description: User information endpoints
  - name: api-keys
    description: API Keys management and validation
paths:
  /invoices/{uuid}/xml:
    get:
      tags:
        - invoices
      summary: Download the stamped CFDI XML
      description: >-
        Authenticate with either a Supabase session (member of the invoice's
        organization) or an API key belonging to that same organization. Streams
        back the exact XML returned by the PAC at stamping time, as stored in
        `invoices.xml`.
      operationId: InvoicesController_downloadXml
      parameters:
        - name: uuid
          required: true
          in: path
          schema:
            type: string
      responses:
        '200':
          description: XML del CFDI timbrado
        '403':
          description: Caller does not belong to the invoice's organization
        '404':
          description: uuid does not match any invoice
      security:
        - apiKey: []
        - bearer: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'API Key for authentication (format: sk_...)'
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````