Skip to main content
Liveness / degraded-mode snapshot. Public, unauthenticated.
TL;DRGET /system/status is a public readiness snapshot: is matching running, is settlement wired, is an oracle attached, and what slot the engine is on. A degraded flag tells you, in one boolean, whether to back off before you hit a write failure.

GET /system/status

Public, with no authentication.

Response

When degradation occurs

The venue is degraded when a core subsystem is unavailable: the matching tick is not running, the settlement pipeline is not wired, or the finalized governance/signer view no longer matches the boot-approved configuration. On a multi-market venue, a governed-market mismatch pauses new trading venue-wide rather than leaving some books running against uncertain authority. An oracle failure is narrower: it pauses only markets bound to the affected feed. In that partial state degraded is true, matcher_running can remain true, and each /instruments entry reports its own trading_enabled value. Under a venue-wide readiness failure, new place and modify operations fail closed with 503 Service Unavailable for every market. Under market-local oracle degradation, only place/modify for the affected market fails; a healthy symbol whose own trading_enabled remains true can continue even while the venue-level degraded summary is true. Cancels, authenticated reads, and reconciliation continue so a trader can reduce risk and the engine can resolve already-pending settlements.

How it manifests

Best practices

  • Use both readiness levels. Check /system/status for venue health, then the chosen /instruments/{symbol} entry’s trading_enabled value. Always handle a racing 503 from place/modify. Do not block a healthy symbol merely because another market makes the venue-level degraded summary true.
  • Use it, not /health, for readiness. /health answers “is the process up”; /system/status answers “can I trade right now.”
  • Back off and poll. On a 503, refresh /system/status plus the requested instrument. Resume that symbol when its own trading_enabled is true; do not wait for degraded=false when only another market remains paused. A venue-wide failure keeps every instrument disabled until global readiness recovers.
  • Surface it. It is public and leaks nothing, so it is safe to show on a status page or wire into client-side health checks.

Response

Engine status snapshot.

degraded
boolean
required

true when any market is paused or matching/governance/settlement readiness is down.

matcher_running
boolean
required

true when at least one configured market can accept and match new orders.

settle_enabled
boolean
required

The on-chain settle pipeline is wired.

oracle_configured
boolean
required

An oracle cache (clearing-price reference) is attached.

oracle_mode
enum<string> | null
required

Versioned oracle source selected exclusively at boot.

Available options:
pyth-router-quorum-v1,
pyth-solana-push-v1,
null
oracle_max_age_ms
integer<uint64> | null
required

Source-specific signed-price age budget.

current_slot
integer<uint64>
required
version
string
required