> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# List Request Logs

> Requests made with your API keys in the last 30 days, newest first. API key needs `read:request-logs`; a session must be owner or admin.

Returns the log of API requests made with your organization's API keys, newest first. Use it to find out what a failing request looked like, which key sent it, and why it was rejected.

> This endpoint takes no `organizationId` in the URL. Authenticate with **either** an API key (the organization resolves automatically from the key) **or** a Supabase Bearer session (send the `X-Organization-Id: <org-id>` header — the user must be an **owner** or **admin** of that organization).

## What is recorded

* Requests authenticated with an API key (`X-API-Key: sk_...` or `Authorization: Bearer sk_...`).
* Rejected requests whose key really exists, with `authFailure` set to the reason: `inactive` (revoked key), `expired`, `ip_not_allowed` or `missing_scope`.
* `429` rate-limited requests made with a known key.

## What is not recorded

* Requests made from the dashboard (session).
* Requests with an unknown key.
* Request bodies and the bodies of successful responses.
* `OPTIONS`, health and docs routes.

Records are kept for **30 days**.

## Authentication

Accepts **either**:

* An API key (`X-API-Key: sk_...`) with the `read:request-logs` scope — the organization is resolved from the key itself.
* A Supabase Bearer session (`Authorization: Bearer <token>`) with the `X-Organization-Id: <org-id>` header — the authenticated user must be an owner or admin of that organization. A member gets `403 Forbidden`.

## Query Parameters

| Parameter | Type | Required | Default | Description |
| - | - | - | - | - |
| `from` | string (ISO 8601) | No | 24 hours before `to` | Start of the range |
| `to` | string (ISO 8601) | No | now | End of the range. The maximum range is 30 days; an invalid range returns `400` |
| `status` | string | No | — | Comma-separated list of classes (`2xx`, `4xx`, `5xx`) and exact codes, OR-ed. Up to 20. A single value works as before |
| `method` | string | No | — | Comma-separated list of `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, OR-ed |
| `q` | string | No | — | Case-insensitive *contains* search on the real request path. 1–200 characters; `%` and `_` match literally |
| `minDurationMs` | integer | No | — | Lower latency bound in milliseconds (0–600000). Greater than `maxDurationMs` returns `400` |
| `maxDurationMs` | integer | No | — | Upper latency bound in milliseconds (0–600000) |
| `route` | string | No | — | Route template, e.g. `/invoices/:uuid` |
| `apiKeyId` | string (uuid) | No | — | Only requests made with this API key |
| `environment` | `"sandbox"` \| `"production"` | No | — | Filter by environment |
| `channel` | `"web"` \| `"api"` \| `"sdk"` \| `"cli"` \| `"mcp"` | No | — | Filter by the channel the request came from |
| `authFailure` | string | No | — | `any` for every rejected request, or one of `inactive`, `expired`, `ip_not_allowed`, `missing_scope` |
| `cursor` | string | No | — | The `nextCursor` value from the previous page. An invalid cursor returns `400` |
| `limit` | integer | No | `50` | Results per page (1-100) |

## Pagination

The response includes `nextCursor`. Send it as `cursor` to get the next page. When `nextCursor` is `null` there are no more results.

## Example Request

```bash theme={null}
curl "https://api.timbrix.mx/request-logs?status=5xx" \
  -H "X-API-Key: sk_..."
```

```typescript theme={null}
import { Timbrix } from "@timbrix/sdk"

const client = new Timbrix({ apiKey: "sk_..." })

const { data, nextCursor } = await client.requestLogs.list({
  status: ["4xx", 500],
})
console.log(data, nextCursor)
```

With a session, pass the organization as the second argument:

```typescript theme={null}
const page = await client.requestLogs.list(
  { status: "5xx" },
  "550e8400-e29b-41d4-a716-446655440000"
)
```

## Example Response

```json theme={null}
{
  "data": [
    {
      "id": "0f8b2c1e-6a4d-4c43-9d6e-3b1f6a9e7c10",
      "createdAt": "2026-10-14T18:32:10.482Z",
      "method": "POST",
      "route": "/invoices",
      "path": "/invoices",
      "statusCode": 500,
      "durationMs": 842,
      "environment": "production",
      "channel": "sdk",
      "authFailure": null,
      "apiKey": {
        "id": "7d3a9c52-1f0e-4a8b-b6c4-2e5d8f9a1b33",
        "name": "Production API Key",
        "keyPreview": "...ab12"
      }
    },
    {
      "id": "5c1d7e90-3b2a-4f6e-8a1d-9e4b0c7a2d55",
      "createdAt": "2026-10-14T18:30:02.117Z",
      "method": "GET",
      "route": "/invoices/:uuid",
      "path": "/invoices/3f1c9a52-7b1e-4d3a-9c0f-8a2b6e4d1c77",
      "statusCode": 401,
      "durationMs": 12,
      "environment": "production",
      "channel": "api",
      "authFailure": "inactive",
      "apiKey": {
        "id": "a91e4d07-5c3b-42f8-8d1a-6b7c0e2f9d44",
        "name": "Old integration key",
        "keyPreview": "...cd34"
      }
    }
  ],
  "nextCursor": "eyJjIjoiMjAyNi0xMC0xNFQxODozMDowMi4xMTdaIn0"
}
```

`apiKey` is `null` when the key was deleted after the request was made.

## Common Errors

### 400 Bad Request

Invalid `from`/`to` range (or more than 30 days), invalid `cursor`, or a filter with an unsupported value. Also returned when `X-Organization-Id` is missing on a session-authenticated request.

### 401 Unauthorized

Missing or invalid Bearer token / API key.

### 403 Forbidden

The authenticated user is not an owner or admin of the organization, or the API key does not have the `read:request-logs` scope.


## OpenAPI

````yaml GET /request-logs
openapi: 3.0.0
info:
  title: Timbrix API
  description: >-
    API de facturación electrónica CFDI 4.0 para México, con servidor OAuth2
    para gestionar organizaciones, miembros y webhooks. Compatible con agentes
    de IA — ver la extensión `x-ai-agent-friendly` en la raíz de esta spec.


    REST API with OAuth2 server for managing organizations, members, and
    webhooks.
  version: '1.0'
  contact: {}
servers: []
security: []
tags:
  - name: organizations
    description: Organization management endpoints
  - name: oauth
    description: OAuth2 authentication and authorization
  - name: webhooks
    description: Webhook configuration and delivery
  - name: users
    description: User information endpoints
  - name: api-keys
    description: API Keys management and validation
  - name: request-logs
    description: API request log
paths:
  /request-logs:
    get:
      tags:
        - request-logs
      summary: List API requests
      description: >-
        Requests made with your API keys in the last 30 days, newest first. API
        key needs `read:request-logs`; a session must be owner or admin.
      operationId: RequestLogsController_list
      parameters:
        - name: from
          required: false
          in: query
          description: 'Inicio (ISO 8601). Default: to - 24 h'
          schema:
            type: string
        - name: to
          required: false
          in: query
          description: 'Fin (ISO 8601). Default: ahora'
          schema:
            type: string
        - name: status
          required: false
          in: query
          description: >-
            Lista separada por comas de clases (2xx, 4xx, 5xx) y códigos
            exactos. Hasta 20.
          schema:
            example: 4xx,500
            type: string
        - name: method
          required: false
          in: query
          description: Lista separada por comas de GET, POST, PUT, PATCH, DELETE.
          schema:
            example: GET,POST
            type: string
        - name: q
          required: false
          in: query
          description: Busca en el path real (contiene, sin distinguir mayúsculas).
          schema:
            example: /invoices
            type: string
        - name: route
          required: false
          in: query
          schema:
            type: string
            example: /invoices/:uuid
        - name: apiKeyId
          required: false
          in: query
          schema:
            type: string
        - name: environment
          required: false
          in: query
          schema:
            type: string
            enum:
              - sandbox
              - production
        - name: channel
          required: false
          in: query
          schema:
            type: string
            enum:
              - web
              - api
              - sdk
              - cli
              - mcp
        - name: authFailure
          required: false
          in: query
          schema:
            type: string
            enum:
              - any
              - inactive
              - expired
              - ip_not_allowed
              - missing_scope
        - name: minDurationMs
          required: false
          in: query
          schema:
            minimum: 0
            maximum: 600000
            type: number
        - name: maxDurationMs
          required: false
          in: query
          schema:
            minimum: 0
            maximum: 600000
            type: number
        - name: cursor
          required: false
          in: query
          description: nextCursor de la página anterior
          schema:
            type: string
        - name: limit
          required: false
          in: query
          schema:
            minimum: 1
            maximum: 100
            default: 50
            type: number
        - name: X-Organization-Id
          in: header
          description: >-
            Required for Supabase session auth (owner or admin). Ignored with an
            API key.
          required: false
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRequestLogsResponseDto'
      security:
        - apiKey: []
        - bearer: []
components:
  schemas:
    ListRequestLogsResponseDto:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/RequestLogItemDto'
        nextCursor:
          type: object
          nullable: true
      required:
        - data
    RequestLogItemDto:
      type: object
      properties:
        id:
          type: string
          description: También es el header X-Request-Id
        createdAt:
          type: string
        method:
          type: string
        route:
          type: string
          example: /invoices/:uuid
        path:
          type: string
        statusCode:
          type: number
        durationMs:
          type: number
        environment:
          type: string
          enum:
            - sandbox
            - production
          nullable: true
        channel:
          type: object
          nullable: true
        authFailure:
          type: object
          nullable: true
        apiKey:
          nullable: true
          type: object
          allOf:
            - $ref: '#/components/schemas/RequestLogApiKeyDto'
      required:
        - id
        - createdAt
        - method
        - route
        - path
        - statusCode
        - durationMs
    RequestLogApiKeyDto:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        keyPreview:
          type: string
          example: ...a1b2
      required:
        - id
        - name
        - keyPreview
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'API Key for authentication (format: sk_...)'
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.