> ## Documentation Index > Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt > Use this file to discover all available pages before exploring further. # Export Invoices as XML ZIP > Capped at 500 matching invoices per request. Exports invoices matching the given filters as a ZIP file containing one CFDI XML file per invoice, named by UUID. > **Note**: The export is limited to 500 invoices per request. If the filter matches more than 500 invoices, the endpoint returns a 400 error. To export larger datasets, use multiple requests with narrower date ranges or other filters. ## Authentication Accepts **either**: * A Supabase Bearer session (`Authorization: Bearer `) with the `X-Organization-Id: ` header. * An API key (`X-API-Key: sk_...`) with the `read:invoices` scope. ## Query Parameters | Parameter | Type | Description | | ------------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dateFrom` | string (ISO date) | Filtra por fecha de registro en Timbrix (`createdAt`), desde (inclusive). Un valor de solo fecha (`YYYY-MM-DD`) se ancla al **inicio** del día en America/Mexico\_City. | | `dateTo` | string (ISO date) | Filtra por fecha de registro en Timbrix (`createdAt`), hasta (inclusive). Un valor de solo fecha (`YYYY-MM-DD`) se ancla al **final** del día (23:59:59.999) en America/Mexico\_City. | | `type` | `"I"` \| `"E"` \| `"T"` | Filtra por tipo de comprobante | | `status` | `"vigente"` \| `"cancelado"` | Filtra por estatus | | `rfcReceptor` | string | Filtra por RFC exacto del receptor | | `environment` | `"sandbox"` \| `"production"` | Filtra por entorno. Ignorado con API key (siempre usa el entorno de la key). Con sesión de Supabase, **por defecto es `production`** — pasa `environment=sandbox` explícitamente para incluir CFDI de sandbox. | ## Example Request ```bash cURL theme={null} curl -X GET "https://api.timbrix.mx/invoices/report/export/xml.zip?dateFrom=2026-08-01&dateTo=2026-08-31" \ -H "Authorization: Bearer " \ -H "X-Organization-Id: 550e8400-e29b-41d4-a716-446655440000" \ -o invoices.zip ``` ```typescript TypeScript SDK theme={null} const zipBuffer = await timbrix.invoices.exportXmlZip( { dateFrom: "2026-08-01", dateTo: "2026-08-31" }, "550e8400-e29b-41d4-a716-446655440000" ) console.log(zipBuffer) ``` ## Example Response ZIP file containing XML files: ``` invoices.zip ├── d3bfbc57-44af-4390-a064-f0afab85e5df.xml ├── e4cfccd68-55bg-5401-b175-g1bgbc96f6eg.xml └── f5dgddde79-66ch-6512-c286-h2chcd07g7fh.xml ``` Each XML file is a valid CFDI 4.0 comprobante stamped by the PAC. ## Common Errors ### 400 Bad Request The filter matches more than 500 invoices. Use narrower date ranges or additional filters to reduce the result set. ### 401 Unauthorized Missing or invalid Bearer token / API key. ### 403 Forbidden The authenticated user is not a member of the organization sent in `X-Organization-Id`, or the API key does not have the `read:invoices` scope. ## OpenAPI ````yaml GET /invoices/report/export/xml.zip openapi: 3.1.0 info: title: Timbrix API description: >- REST API with OAuth2 server for managing organizations, members, and webhooks version: '1.0' contact: {} servers: - url: https://api.timbrix.mx description: Production security: [] tags: - name: organizations description: Organization management endpoints - name: oauth description: OAuth2 authentication and authorization - name: webhooks description: Webhook configuration and delivery - name: users description: User information endpoints - name: api-keys description: API Keys management and validation paths: /invoices/report/export/xml.zip: get: tags: - invoices summary: Export a filtered set of invoices as a ZIP of their stamped XML description: Capped at 500 matching invoices per request. operationId: InvoicesController_exportXmlZip parameters: - name: dateFrom required: false in: query description: >- Filtra por fecha de registro en Timbrix (createdAt), desde (inclusive, ISO 8601). Un valor de solo fecha (YYYY-MM-DD) se ancla al inicio del día en America/Mexico_City. schema: example: '2026-08-01' type: string - name: dateTo required: false in: query description: >- Filtra por fecha de registro en Timbrix (createdAt), hasta (inclusive, ISO 8601). Un valor de solo fecha (YYYY-MM-DD) se ancla al final del día (23:59:59.999) en America/Mexico_City, incluyendo el día completo. schema: example: '2026-08-31' type: string - name: type required: false in: query description: Filtra por tipo de comprobante schema: type: string enum: - I - E - T - name: status required: false in: query description: Filtra por estatus schema: type: string enum: - vigente - cancelado - name: rfcReceptor required: false in: query description: Filtra por RFC exacto del receptor schema: example: XAXX010101000 type: string - name: environment required: false in: query description: >- Filtra por entorno. Ignorado para peticiones autenticadas con API key (siempre se usa el entorno de la key). Para una sesión de Supabase, por defecto es 'production' — pasa este parámetro para incluir CFDI de sandbox. schema: type: string enum: - sandbox - production - name: X-Organization-Id in: header description: >- Required for Supabase session auth. Ignored when authenticating with an API key (the organization resolves from the key). required: false schema: type: string responses: '200': description: ZIP con los XML timbrados '400': description: Demasiadas facturas coinciden con el filtro security: - apiKey: [] - bearer: [] components: securitySchemes: apiKey: type: apiKey in: header name: X-API-Key description: 'API Key for authentication (format: sk_...)' bearer: scheme: bearer bearerFormat: JWT type: http ````