Batch cancel orders

curl --request POST \
  --url https://api.arcus.xyz/v1/batchCancelOrders \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "cancels": [
    {
      "address": "<string>",
      "marketId": 32767,
      "accountIndex": 4,
      "kind": "orderId",
      "orderId": "<string>",
      "validUntil": 123,
      "signature": "<string>",
      "timestamp": 4611686018427388000
    }
  ]
}
'

import requests

url = "https://api.arcus.xyz/v1/batchCancelOrders"

payload = { "cancels": [
        {
            "address": "<string>",
            "marketId": 32767,
            "accountIndex": 4,
            "kind": "orderId",
            "orderId": "<string>",
            "validUntil": 123,
            "signature": "<string>",
            "timestamp": 4611686018427388000
        }
    ] }
headers = {
    "X-API-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "X-Signature": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-API-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'X-Signature': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    cancels: [
      {
        address: '<string>',
        marketId: 32767,
        accountIndex: 4,
        kind: 'orderId',
        orderId: '<string>',
        validUntil: 123,
        signature: '<string>',
        timestamp: 4611686018427388000
      }
    ]
  })
};

fetch('https://api.arcus.xyz/v1/batchCancelOrders', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.arcus.xyz/v1/batchCancelOrders",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'cancels' => [
        [
                'address' => '<string>',
                'marketId' => 32767,
                'accountIndex' => 4,
                'kind' => 'orderId',
                'orderId' => '<string>',
                'validUntil' => 123,
                'signature' => '<string>',
                'timestamp' => 4611686018427388000
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.arcus.xyz/v1/batchCancelOrders"

	payload := strings.NewReader("{\n  \"cancels\": [\n    {\n      \"address\": \"<string>\",\n      \"marketId\": 32767,\n      \"accountIndex\": 4,\n      \"kind\": \"orderId\",\n      \"orderId\": \"<string>\",\n      \"validUntil\": 123,\n      \"signature\": \"<string>\",\n      \"timestamp\": 4611686018427388000\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.arcus.xyz/v1/batchCancelOrders")
  .header("X-API-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("X-Signature", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"cancels\": [\n    {\n      \"address\": \"<string>\",\n      \"marketId\": 32767,\n      \"accountIndex\": 4,\n      \"kind\": \"orderId\",\n      \"orderId\": \"<string>\",\n      \"validUntil\": 123,\n      \"signature\": \"<string>\",\n      \"timestamp\": 4611686018427388000\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.arcus.xyz/v1/batchCancelOrders")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["X-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"cancels\": [\n    {\n      \"address\": \"<string>\",\n      \"marketId\": 32767,\n      \"accountIndex\": 4,\n      \"kind\": \"orderId\",\n      \"orderId\": \"<string>\",\n      \"validUntil\": 123,\n      \"signature\": \"<string>\",\n      \"timestamp\": 4611686018427388000\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "responses": [
    {
      "address": "<string>",
      "accountIndex": 4,
      "marketId": 32767,
      "marketDisplayName": "<string>",
      "updateTime": 123,
      "orderId": "<string>",
      "clientId": "<string>",
      "remainingSize": "<string>",
      "filledSize": "<string>",
      "rateLimit": {
        "remaining": 123
      }
    }
  ],
  "rateLimit": {
    "remaining": 123
  }
}

{
  "responses": [
    {
      "address": "<string>",
      "accountIndex": 4,
      "marketId": 32767,
      "marketDisplayName": "<string>",
      "updateTime": 123,
      "orderId": "<string>",
      "clientId": "<string>",
      "remainingSize": "<string>",
      "filledSize": "<string>",
      "rateLimit": {
        "remaining": 123
      }
    }
  ],
  "rateLimit": {
    "remaining": 123
  }
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "rate limited",
  "reason": "account_empty",
  "retryAfterMs": 850,
  "clientId": "my-order-42"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

POST

batchCancelOrders

Batch cancel orders

curl --request POST \
  --url https://api.arcus.xyz/v1/batchCancelOrders \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "cancels": [
    {
      "address": "<string>",
      "marketId": 32767,
      "accountIndex": 4,
      "kind": "orderId",
      "orderId": "<string>",
      "validUntil": 123,
      "signature": "<string>",
      "timestamp": 4611686018427388000
    }
  ]
}
'

import requests

url = "https://api.arcus.xyz/v1/batchCancelOrders"

payload = { "cancels": [
        {
            "address": "<string>",
            "marketId": 32767,
            "accountIndex": 4,
            "kind": "orderId",
            "orderId": "<string>",
            "validUntil": 123,
            "signature": "<string>",
            "timestamp": 4611686018427388000
        }
    ] }
headers = {
    "X-API-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "X-Signature": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-API-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'X-Signature': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    cancels: [
      {
        address: '<string>',
        marketId: 32767,
        accountIndex: 4,
        kind: 'orderId',
        orderId: '<string>',
        validUntil: 123,
        signature: '<string>',
        timestamp: 4611686018427388000
      }
    ]
  })
};

fetch('https://api.arcus.xyz/v1/batchCancelOrders', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.arcus.xyz/v1/batchCancelOrders",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'cancels' => [
        [
                'address' => '<string>',
                'marketId' => 32767,
                'accountIndex' => 4,
                'kind' => 'orderId',
                'orderId' => '<string>',
                'validUntil' => 123,
                'signature' => '<string>',
                'timestamp' => 4611686018427388000
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.arcus.xyz/v1/batchCancelOrders"

	payload := strings.NewReader("{\n  \"cancels\": [\n    {\n      \"address\": \"<string>\",\n      \"marketId\": 32767,\n      \"accountIndex\": 4,\n      \"kind\": \"orderId\",\n      \"orderId\": \"<string>\",\n      \"validUntil\": 123,\n      \"signature\": \"<string>\",\n      \"timestamp\": 4611686018427388000\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.arcus.xyz/v1/batchCancelOrders")
  .header("X-API-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("X-Signature", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"cancels\": [\n    {\n      \"address\": \"<string>\",\n      \"marketId\": 32767,\n      \"accountIndex\": 4,\n      \"kind\": \"orderId\",\n      \"orderId\": \"<string>\",\n      \"validUntil\": 123,\n      \"signature\": \"<string>\",\n      \"timestamp\": 4611686018427388000\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.arcus.xyz/v1/batchCancelOrders")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["X-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"cancels\": [\n    {\n      \"address\": \"<string>\",\n      \"marketId\": 32767,\n      \"accountIndex\": 4,\n      \"kind\": \"orderId\",\n      \"orderId\": \"<string>\",\n      \"validUntil\": 123,\n      \"signature\": \"<string>\",\n      \"timestamp\": 4611686018427388000\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "responses": [
    {
      "address": "<string>",
      "accountIndex": 4,
      "marketId": 32767,
      "marketDisplayName": "<string>",
      "updateTime": 123,
      "orderId": "<string>",
      "clientId": "<string>",
      "remainingSize": "<string>",
      "filledSize": "<string>",
      "rateLimit": {
        "remaining": 123
      }
    }
  ],
  "rateLimit": {
    "remaining": 123
  }
}

{
  "responses": [
    {
      "address": "<string>",
      "accountIndex": 4,
      "marketId": 32767,
      "marketDisplayName": "<string>",
      "updateTime": 123,
      "orderId": "<string>",
      "clientId": "<string>",
      "remainingSize": "<string>",
      "filledSize": "<string>",
      "rateLimit": {
        "remaining": 123
      }
    }
  ],
  "rateLimit": {
    "remaining": 123
  }
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "rate limited",
  "reason": "account_empty",
  "retryAfterMs": 850,
  "clientId": "my-order-42"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

{
  "error": "<string>",
  "code": "GEO_RESTRICTED"
}

The response body shown here is a static example, not live data. After you click Send, your live result appears in a separate panel headed 200 OK. The panel under the status-code tabs is a fixed sample from the spec — its field values (fees, prices, sizes, IDs, timestamps) are placeholders. Use Send, or call the endpoint, for current values.

Cancel up to 100 orders in a single request. Requires address query parameter matching the master Ethereum address for X-API-Key. Signed per order. This endpoint requires the X-Signature header to be present (non-empty); its value is not verified — set it to any one element’s signature. Omitting it rejects every element with invalid order signature. Each element of cancels carries its own signature over the ordersign typed canonical payload for that cancel (op 2) — the same bytes a standalone cancelOrder signs; the shared X-API-Key + X-Timestamp headers authenticate the batch.

Response behavior

Asynchronous. The endpoint returns either 202 Accepted (the common case — the batch cancel was forwarded to the matching engine and per-order rows do not carry terminal state) or 200 OK (the gateway already had definitive state by the time it responded; per-order status reflects that state). In both cases each row echoes the targeted orderId / clientId so subscribers can correlate WebSocket events with the request. To observe each order’s resulting state (CANCELED / FILLED) clients must subscribe to the orders WebSocket channel.

Authorizations

X-API-Key

string

header

required

Hex-encoded Ed25519 public key (64 chars). The public key IS the API key — register it via POST /createApiKey. Required on every authenticated request, both read-only and signed.

X-Timestamp

string

header

required

Unix time in nanoseconds as a decimal string (e.g. "1713825891591000000"). Millisecond or second epochs are rejected with 401 Unauthorized. Must be within ±30,000 ms (MaxTimestampDriftMs, the drift window stays configured in milliseconds) of server wall-clock, or the request is rejected with 401 Unauthorized. Required on all mutating / credential-creating endpoints. This same value must appear as the ct field in the ordersign typed canonical payload (single-order endpoints) or in each element's ct field (batch endpoints).

X-Signature

string

header

required

Lowercase hex-encoded Ed25519 signature (128 chars).

Single-order endpoints (placeOrder, cancelOrder, modifyOrder, and other non-batch mutating routes) sign over the ordersign typed canonical payload — a compact, key-sorted JSON object built from parsed request fields using engine-native integer values:

placeOrder:   {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,"g":N,"m":N,"op":1,"p":N,"q":N,"r":0|1,"s":N,"t":N,"v":1}
cancelOrder:  {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,[,"id":"…"],"m":N,"op":2,"v":1}
modifyOrder:  {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,"g":N,"id":"…","m":N,"op":3,"p":N,"q":N,"r":0|1,"s":N,"t":N,"v":1}

ct must equal the X-Timestamp header value. Keys in brackets are conditional (omitted when empty). op values: 1=place, 2=cancel, 3=modify. See the ordersign package for field definitions and reference signing code.

Other signed routes (e.g. createApiKey, tokens, userPreferences) still use the legacy scheme: signing_message = X-Timestamp + ACTION + canonicalJSON(body), where ACTION is the camelCase final path segment.

Batch endpoints (batchPlaceOrders, batchCancelOrders) do NOT use this header. They authenticate with per-element typed ordersign signatures embedded in the request body (see the global auth description and the per-field signature descriptions on OrderRequest / CancelOrderRequest).

Read endpoints are authenticated by ?address= (and optionally X-API-Key) only — no signature is required. The one exception is GET /v1/affiliate/inviteCodes, which returns bearer secrets and therefore requires the full header triple; with no body its signing message is X-Timestamp + ACTION. canonicalJSON(body) is the JSON body with object keys sorted lexicographically at every level and no whitespace; the server canonicalizes the received body before verifying, so only the bytes signed over must be canonical. Required on all mutating / credential-creating endpoints.

Query Parameters

address

string

required

Master Ethereum address for this API key (must match address from POST /createApiKey for the same key). Required on REST for account-scoped reads and for place/cancel. Invalid hex → 400; mismatch with key → 403.

20-byte EVM address as hex: optional 0x or 0X prefix and exactly 40 hexadecimal digits. API responses normalize to lowercase a–f after 0x.

Pattern: ^(0x|0X)?[0-9a-fA-F]{40}$

Body

application/json

cancels

object[]

required

Array of 1-100 cancel requests.

Required array length: 1 - 100 elements

Cancel target is exactly one of orderId (server-generated, CancelByOrderId) or clientId (from place order, CancelByClientId). Sending both is rejected by the server with HTTP 400.

Option 1
Option 2

Show child attributes

Response

Batch cancel processed and the gateway already has definitive state for the rows. Per-order status reflects that state. Treat as best-effort enrichment of the 202 path; the orders WebSocket channel is still the source of truth.

responses

object[]

required

Show child attributes

rateLimit

object

Per-subaccount cancel-pool rate-limit snapshot after charging the whole batch (one snapshot for the request, not per row). Omitted when rate limiting is not configured.

Show child attributes

API documentation

Endpoints

WebSocket

Changelog

Batch cancel orders

Response behavior

Authorizations

Query Parameters

Body

Response

​Response behavior

Authorizations

Query Parameters

Body

Response

Response behavior