Skip to main content
POST
/
v1
/
cancelAllOrders
curl --request POST \
  --url https://api.testnet.arcus.xyz/v1/cancelAllOrders \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "address": "0x1234567890abcdef1234567890abcdef12345678",
  "accountIndex": 0,
  "marketId": 1
}
'
{
  "address": "<string>",
  "accountIndex": 4,
  "updateTime": 123,
  "marketId": 32767,
  "marketDisplayName": "<string>",
  "rateLimit": {
    "remaining": 123
  }
}
Cancel every open order for (address, accountIndex). Pass marketId to restrict the cancel to a single market; omit it to cancel every open order across every market on the account. Untriggered TPSL orders within the scope are canceled too.

​
Response behavior

Asynchronous. Returns 202 Accepted with status = CANCEL_ALL_ACKNOWLEDGED once the request is forwarded to the matching engine. Per-order CANCELED events flow over the orders WebSocket channel as the engine processes each affected order — clients must subscribe to that channel to observe the resulting state. Rate-limit cost is one unit per request, identical to cancelOrder and batchCancelOrders, regardless of how many orders end up being canceled.

Authorizations

​
X-API-Key
string
header
required

Hex-encoded Ed25519 public key (64 chars). The public key IS the API key — register it via POST /createApiKey. Required on every authenticated request, both read-only and signed.

​
X-Timestamp
string
header
required

Unix time in nanoseconds as a decimal string (e.g. "1713825891591000000"). Millisecond or second epochs are rejected with 401 Unauthorized. Must be within ±30,000 ms (MaxTimestampDriftMs, the drift window stays configured in milliseconds) of server wall-clock, or the request is rejected with 401 Unauthorized. Required on all mutating / credential-creating endpoints. This same value must appear as the ct field in the ordersign typed canonical payload (single-order endpoints) or in each element's ct field (batch endpoints).

​
X-Signature
string
header
required

Lowercase hex-encoded Ed25519 signature (128 chars).

Single-order endpoints (placeOrder, cancelOrder, modifyOrder, and other non-batch mutating routes) sign over the ordersign typed canonical payload — a compact, key-sorted JSON object built from parsed request fields using engine-native integer values:

placeOrder:   {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,"g":N,"m":N,"op":1,"p":N,"q":N,"r":0|1,"s":N,"t":N,"v":1}
cancelOrder:  {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,[,"id":"…"],"m":N,"op":2,"v":1}
modifyOrder:  {"ad":"0x…","ai":N,[,"c":"…"],"ct":N,[,"id":"…"],"m":N,"op":3,"p":N,"q":N,"v":1}

ct must equal the X-Timestamp header value. Keys in brackets are conditional (omitted when empty). op values: 1=place, 2=cancel, 3=modify. See the ordersign package for field definitions and reference signing code.

Other signed routes (e.g. createApiKey, tokens, userPreferences) still use the legacy scheme: signing_message = X-Timestamp + ACTION + canonicalJSON(body), where ACTION is the camelCase final path segment.

Batch endpoints (batchPlaceOrders, batchCancelOrders) do NOT use this header. They authenticate with per-element typed ordersign signatures embedded in the request body (see the global auth description and the per-field signature descriptions on OrderRequest / CancelOrderRequest).

Read endpoints are authenticated by ?address= (and optionally X-API-Key) only — no signature is required. canonicalJSON(body) is the JSON body with object keys sorted lexicographically at every level and no whitespace; the server canonicalizes the received body before verifying, so only the bytes signed over must be canonical. Required on all mutating / credential-creating endpoints.

Query Parameters

​
address
string
required

Master Ethereum address for this API key (must match address from POST /createApiKey for the same key). Required on REST for account-scoped reads and for place/cancel. Invalid hex → 400; mismatch with key → 403.

20-byte EVM address as hex: optional 0x or 0X prefix and exactly 40 hexadecimal digits. API responses normalize to lowercase a–f after 0x.

Pattern: ^(0x|0X)?[0-9a-fA-F]{40}$

Body

application/json

Cancel every open order for (address, accountIndex). Pass marketId to restrict the cancel to a single market; omit it to cancel every open order across every market on the account. Untriggered TPSL orders within the scope are canceled too.

​
address
string
required

Master Ethereum address for this API key (must match ?address= if both are present).

Example:

"0x1234567890abcdef1234567890abcdef12345678"

​
accountIndex
integer
required

Account index (0–9).

Required range: 0 <= x <= 9
​
marketId
integer

Optional. When present, the cancel is scoped to this market only. When omitted, every open order on the account is canceled (account-wide).

Required range: 0 <= x <= 65535
​
validUntil
integer<int64>

Optional non-negative epoch ms after which the request must not be processed.

Response

Cancel-all accepted and forwarded to the matching engine.

Cancel-all is asynchronous. The body is a fixed acknowledgement; per-order cancel events flow over the orders WebSocket channel as the matching engine processes each affected order. To observe the resulting CANCELED events clients must subscribe to that channel.

​
address
string
required
​
accountIndex
integer
required
Required range: 0 <= x <= 9
​
status
enum<string>
required

Always CANCEL_ALL_ACKNOWLEDGED on success.

Available options:
PENDING,
OPEN,
PARTIALLY_FILLED,
FILLED,
CANCELED,
MARGIN_CANCELED,
REJECTED,
UNTRIGGERED,
TPSL_PLACED,
TPSL_TRIGGERED,
TPSL_CANCELED,
LIQUIDATED,
ADL,
ACK,
CANCEL_ACKNOWLEDGED,
CANCEL_ALL_ACKNOWLEDGED,
CANCEL_PENDING,
ERROR
Example:

"CANCEL_ALL_ACKNOWLEDGED"

​
updateTime
integer<int64>
required

Gateway clock epoch microseconds at the moment the request was forwarded to go-core.

​
marketId
integer

Echoed when the request scoped to a single market; omitted for account-wide cancel.

Required range: 0 <= x <= 65535
​
marketDisplayName
string

Echoed when the request scoped to a single market; omitted for account-wide cancel.

Example:

"BTC-USD"

​
rateLimit
object

Per-subaccount cancel-pool rate-limit snapshot after charging this cancel-all. Omitted when rate limiting is not configured.