> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# Download Invoice XML

> Authenticate with either a Supabase session (member of the invoice's organization) or an API key with the `read:invoices` scope belonging to that same organization. Returns the raw CFDI XML file as a download (`Content-Type: application/xml`), not a JSON envelope.

Returns the raw CFDI XML file for a stamped invoice as a downloadable attachment, rather than embedding it in a JSON response like [Get Invoice](/api-reference/invoices/get) does. Like [Cancel Invoice](/api-reference/invoices/cancel), this is a **flat** route — it does not carry `/organizations/{organizationId}/` in the URL. The invoice's `uuid` (its folio fiscal, globally unique across all organizations) is enough to resolve the owning organization server-side, combined with the caller's own auth context (session or API key).

## Authentication

Accepts **either**:

* A Supabase Bearer session (`Authorization: Bearer <token>`) — the authenticated user must be a member of the invoice's organization.
* An API key (`X-API-Key: sk_...`) with the `read:invoices` scope — the key's own organization must match the invoice's organization, or the request is rejected with `403 Forbidden`.

## Path Parameters

| Parameter | Type          | Required | Description                                                                                               |
| --------- | ------------- | -------- | --------------------------------------------------------------------------------------------------------- |
| `uuid`    | string (UUID) | Yes      | Folio fiscal UUID (`uuidFiscal`) of the invoice to fetch — globally unique, not scoped to an organization |

## Example Request

```bash cURL theme={null}
curl -X GET https://api.timbrix.mx/invoices/d3bfbc57-44af-4390-a064-f0afab85e5df/xml \
  -H "Authorization: Bearer <your_token>" \
  -o invoice.xml
```

```typescript TypeScript SDK theme={null}
// Returns a Blob — write it to disk or hand it to the browser as a download.
const xml = await timbrix.invoices.getXml(
  "d3bfbc57-44af-4390-a064-f0afab85e5df"
)
```

## Example Response

This endpoint does not return a JSON body — it streams the raw XML file with:

| Header                | Value                               |
| --------------------- | ----------------------------------- |
| `Content-Type`        | `application/xml`                   |
| `Content-Disposition` | `attachment; filename="<uuid>.xml"` |

<Note>
  If you need the XML alongside other invoice metadata (`type`, `series`,
  `total`, etc.) in a single JSON payload, use [Get
  Invoice](/api-reference/invoices/get) instead — it returns the same XML
  content inline as the `xml` field.
</Note>

## Common Errors

### 401 Unauthorized

Missing or invalid Bearer token / API key.

### 403 Forbidden

The authenticated user is not a member of the invoice's organization, or the API key does not have the `read:invoices` scope / belongs to a different organization than the one that owns the invoice.

### 404 Not Found

`uuid` does not match any invoice.


## OpenAPI

````yaml GET /invoices/{uuid}/xml
openapi: 3.1.0
info:
  title: Timbrix API
  description: >-
    REST API with OAuth2 server for managing organizations, members, and
    webhooks
  version: '1.0'
  contact: {}
servers:
  - url: https://api.timbrix.mx
    description: Production
security: []
tags:
  - name: organizations
    description: Organization management endpoints
  - name: oauth
    description: OAuth2 authentication and authorization
  - name: webhooks
    description: Webhook configuration and delivery
  - name: users
    description: User information endpoints
  - name: api-keys
    description: API Keys management and validation
  - name: invoices
    description: CFDI 4.0 invoice creation, listing, and cancellation
paths:
  /invoices/{uuid}/xml:
    get:
      tags:
        - invoices
      summary: Download the raw CFDI XML for an invoice
      description: >-
        Authenticate with either a Supabase session (member of the invoice's
        organization) or an API key with the `read:invoices` scope belonging to
        that same organization. Returns the raw CFDI XML file as a download
        (`Content-Type: application/xml`), not a JSON envelope.
      operationId: InvoicesController_getXml
      parameters:
        - name: uuid
          required: true
          in: path
          description: Folio fiscal UUID of the invoice
          schema:
            type: string
      responses:
        '200':
          description: The raw CFDI XML file
          content:
            application/xml:
              schema:
                type: string
        '403':
          description: Caller does not belong to the invoice's organization
        '404':
          description: uuid does not match any invoice
      security:
        - apiKey: []
        - bearer: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'API Key for authentication (format: sk_...)'
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````