Skip to main content
POST
Send the stamped CFDI (XML + PDF) by email to the receptor
Sends the stamped CFDI to the receptor by email, with the XML and PDF attached. Like Cancel Invoice and Download XML, this is a flat route — it does not carry /organizations/{organizationId}/ in the URL. The invoice’s uuid (its folio fiscal, globally unique across all organizations) is enough to resolve the owning organization server-side, combined with the caller’s own auth context (session or API key). If you don’t pass a to address, Timbrix tries to resolve one automatically from the Customer registered in your organization with the invoice’s rfcReceptor. If no such customer exists, or it has no email on file, and you didn’t send to either, the request fails with 400 Bad Request. The email body includes the folio fiscal, series/folio, tipoComprobante, issuer RFC, receptor RFC, and total — the XML and PDF are attached as files.

Authentication

Accepts either:
  • A Supabase Bearer session (Authorization: Bearer <token>) — the authenticated user must be a member of the invoice’s organization.
  • An API key (X-API-Key: sk_...) with the write:invoices scope — the key’s own organization must match the invoice’s organization, or the request is rejected with 403 Forbidden.

Path Parameters

Request Body

Example Request

cURL
TypeScript SDK
CLI
to is optional in every client — omit it to let Timbrix resolve the receptor’s email from the matching Customer record instead.

Example Response

Common Errors

400 Bad Request

No to was sent and no email could be resolved from a Customer matching the invoice’s rfcReceptor.

401 Unauthorized

Missing or invalid Bearer token / API key.

403 Forbidden

The authenticated user is not a member of the invoice’s organization, or the API key does not have the write:invoices scope / belongs to a different organization than the one that owns the invoice.

404 Not Found

uuid does not match any invoice, or does not belong to the caller’s organization.

503 Service Unavailable

Sending the email failed after retries.

Authorizations

X-API-Key
string
header
required

API Key for authentication (format: sk_...)

Path Parameters

uuid
string
required

Body

application/json
to
string

Destination email address. If omitted, resolved from the Customer matching the invoice's rfcReceptor in the organization.

Example:

"contabilidad@cliente.com"

Response

id
string
required
invoiceId
string
required
sentTo
string
required
status
enum<string>
required
Available options:
sent,
failed
createdAt
string<date-time>
required
sentBy
object