Skip to main content
POST
The response body shown here is a static example, not live data. After you click Send, your live result appears in a separate panel headed 200 OK. The panel under the status-code tabs is a fixed sample from the spec — its field values (fees, prices, sizes, IDs, timestamps) are placeholders. Use Send, or call the endpoint, for current values.
Cancel every open order for (address, accountIndex). Pass marketId to restrict the cancel to a single market; omit it to cancel every open order across every market on the account. Untriggered TPSL orders within the scope are canceled too.

Response behavior

Asynchronous. Returns 202 Accepted with status = CANCEL_ALL_ACKNOWLEDGED once the request is forwarded to the matching engine. Per-order CANCELED events flow over the orders WebSocket channel as the engine processes each affected order — clients must subscribe to that channel to observe the resulting state. Rate-limit cost is one unit per request, identical to cancelOrder and batchCancelOrders, regardless of how many orders end up being canceled.

Authorizations

X-API-Key
string
header
required

Hex-encoded Ed25519 public key (64 chars). The public key IS the API key — register it via POST /createApiKey. Required on every authenticated request, both read-only and signed.

X-Timestamp
string
header
required

Unix time in nanoseconds as a decimal string (e.g. "1713825891591000000"). Millisecond or second epochs are rejected with 401 Unauthorized. Must be within ±30,000 ms of server wall-clock, or the request is rejected with 401 Unauthorized. Required on all mutating / credential-creating endpoints. This same value must appear as the ct field in the ordersign typed canonical payload (single-order endpoints) or in each element's ct field (batch endpoints).

X-Signature
string
header
required

Lowercase hex-encoded Ed25519 signature (128 chars).

Single-order endpoints (placeOrder, cancelOrder, modifyOrder, and other non-batch mutating routes) sign over the ordersign typed canonical payload — a compact, key-sorted JSON object built from parsed request fields using engine-native integer values:

ct must equal the X-Timestamp header value. Keys in brackets are conditional (omitted when empty). op values: 1=place, 2=cancel, 3=modify. See the ordersign package for field definitions and reference signing code.

Other signed routes (e.g. createApiKey) still use the legacy scheme: signing_message = X-Timestamp + ACTION + canonicalJSON(body), where ACTION is the camelCase final path segment.

Batch endpoints (batchPlaceOrders, batchCancelOrders, batchModifyOrders) do NOT use this header. They authenticate with per-element typed ordersign signatures embedded in the request body (see the global auth description and the per-field signature descriptions on OrderRequest / CancelOrderRequest / ModifyOrderRequest).

Read endpoints are authenticated by ?address= (and optionally X-API-Key) only — no signature is required, except for the signed affiliate reads (see the Referral tag), which require the full header triple; with no body their signing message is X-Timestamp + ACTION. canonicalJSON(body) is the JSON body with object keys sorted lexicographically at every level and no whitespace; the server canonicalizes the received body before verifying, so only the bytes signed over must be canonical. Required on all mutating / credential-creating endpoints.

Query Parameters

address
string
required

Master Ethereum address for this API key (must match address from POST /createApiKey for the same key). Required on REST for account-scoped reads and for place/cancel. Invalid hex → 400; mismatch with key → 403.

20-byte EVM address as hex: optional 0x or 0X prefix and exactly 40 hexadecimal digits. API responses normalize to lowercase a–f after 0x.

Pattern: ^(0x|0X)?[0-9a-fA-F]{40}$

Body

application/json

Cancel every open order for (address, accountIndex). Pass marketId to restrict the cancel to a single market; omit it to cancel every open order across every market on the account. Untriggered TPSL orders within the scope are canceled too.

address
string
required

Master Ethereum address for this API key (must match ?address= if both are present).

Example:

"0x1234567890abcdef1234567890abcdef12345678"

accountIndex
integer
required

Account index (0–9).

Required range: 0 <= x <= 9
marketId
integer

Optional. When present, the cancel is scoped to this market only. When omitted, every open order on the account is canceled (account-wide).

Required range: 0 <= x <= 65535
validUntil
integer<int64>

Optional non-negative epoch ms after which the request must not be processed.

Response

Cancel-all accepted and forwarded to the matching engine.

Cancel-all is asynchronous. The body is a fixed acknowledgement; per-order cancel events flow over the orders WebSocket channel as the matching engine processes each affected order. To observe the resulting CANCELED events clients must subscribe to that channel.

address
string
required
accountIndex
integer
required
Required range: 0 <= x <= 9
status
enum<string>
required

Always CANCEL_ALL_ACKNOWLEDGED on success.

Available options:
PENDING,
OPEN,
PARTIALLY_FILLED,
FILLED,
CANCELED,
MARGIN_CANCELED,
REJECTED,
UNTRIGGERED,
TPSL_PLACED,
TPSL_TRIGGERED,
TPSL_CANCELED,
LIQUIDATED,
ADL,
ACK,
CANCEL_ACKNOWLEDGED,
CANCEL_ALL_ACKNOWLEDGED,
CANCEL_PENDING,
ERROR
Example:

"CANCEL_ALL_ACKNOWLEDGED"

updateTime
integer<int64>
required

Gateway clock epoch microseconds at the moment the request was forwarded to the matching engine.

marketId
integer

Echoed when the request scoped to a single market; omitted for account-wide cancel.

Required range: 0 <= x <= 65535
marketDisplayName
string

Echoed when the request scoped to a single market; omitted for account-wide cancel.

Example:

"BTC-USD"

rateLimit
object

Per-subaccount cancel-pool rate-limit snapshot after charging this cancel-all. Omitted when rate limiting is not configured.