Skip to main content
Cancel an open order.
TL;DRDELETE /orders/{order_id} removes a resting order. The body carries a fresh trading-key signature over the order id, cancel nonce, and current boot session, proving the caller owns the order. Only the trading key that placed the order can cancel it.
Auth: Authorization: Bearer <token> and a trading-key cancel signature in the body.

Path parameters

Request body

The cancel nonce is part of the signed bytes, so a captured cancel request cannot be replayed to cancel a different (later, same-id) order, because the canonical body, and therefore the signature, differs. The canonical body also binds the boot session, and the nonce must strictly advance per trading key. Together these scope a signed cancel to one venue boot: a cancel captured before a restart cannot be replayed against the session that follows it, and one captured within a session cannot be replayed at all. The session id is the same value place orders bind — the current /info.boot_session_id. If you sign cancels yourself rather than through the SDK, read it once per session and include it; a body missing it will not verify. A CVM restart changes it, so refresh it before signing anything further.

Example

Success response

When an order is cancelled, the engine releases its collateral reservation and drops the in-enclave note opening. A cancelled event is also emitted on the Orders Channel so a streaming client sees the order leave without polling.

Errors

Cancelling races the matchAn order can match in a batch between when you decide to cancel and when the cancel lands. If the order has already left the book, the cancel returns 404. Treat a 404 on cancel as “the order is no longer resting” and reconcile via GET /orders/{order_id} or the orders stream.

Authorizations

Authorization
string
header
required

Short-lived (≤ 1h) bearer token from POST /auth/token.

Expiry is EXACT — there is no grace period past expires_in, on REST or on the streaming transport. Refresh on a margin.

A structurally valid, unexpired token is still refused when it has been revoked (401), when the operator has invalidated the tokens the account was holding (401), or when the account is suspended (403). Suspension also blocks issuing a new one, so re-authenticating does not clear it.

Path Parameters

order_id
string
required

Body

application/json
trading_key
string
required

32-byte Ed25519 pubkey, hex.

cancel_nonce
string
required

Canonical decimal u64 string; strings preserve the full range in JavaScript clients.

Pattern: ^(0|[1-9][0-9]*)$
session_id
string
required

32-byte hex boot session from /info; bound into the cancel signature so a captured body cannot be replayed in a later boot. Programmatic clients verify the same value in the transport-attestation manifest.

trading_key_signature
string
required

64-byte canonical cancel signature, hex.

Response

Cancellation processed.

order_id
string
required
status
enum<string>
required
Available options:
cancelled