Order Entry

Place, modify, and cancel orders, or manage an account's cancel-all-after countdown. Reya verifies signatures, signer permissions, order validity, and applicable pre-trade risk checks before accepting requests.

Rate limits. Account budgets are shared across markets, signers, REST, and WebSocket requests. Create and modify share a placement budget; single cancels, bulk cancels, and cancel-all-after control have separate budgets. Resting orders also have count and notional limits. See the HTTP 400 response reference for errors and recovery guidance.

Every venue verdict is HTTP 400. Rejections carry the reason in the body's error code and an optional retryAfterMs. Branch on the code to decide how to recover. HTTP 429 is reserved for infrastructure-level (per-IP) limits in front of the API and need not use the venue's JSON error format.

Cancellation reasons

Reason for a terminal CANCELLED order. cancelReason and cancelReasonMessage are omitted for other statuses and may be omitted when a cancellation reason is unavailable. Branch on cancelReason; cancelReasonMessage is explanatory text, not a stable contract to parse.

• NO_LIQUIDITY: an IOC order filled nothing at its limit.

• IOC_REMAINDER: an IOC order partially filled and its unfilled quantity was cancelled because no further executable liquidity was available. Both IOC reasons appear on create/modify responses.

• USER_CANCEL, MASS_CANCEL, CANCEL_ALL_AFTER, GTT_EXPIRED: cancellation by a single cancel, bulk cancel, expired cancel-all-after countdown, or GTT expiry. These appear on walletOrderChanges.

• SELF_TRADE_PREVENTION: an order would trade against the account's own resting order. Only the incoming order is cancelled; the resting order stays in place. This can appear on create/modify responses or a crossing modification's order-change event. Any fills already completed remain recorded.

• FEED_RESET: rebuild the local order view from the following order events or GET /v2/wallet/{address}/openOrders. This notification does not mean the orders were cancelled on the exchange.

• RISK_CANCELLED: a resting order was cancelled because it did not pass pre-trade risk checks when it was about to fill. Delivered on walletOrderChanges, with any previous fills preserved. A create or modify refused at request acceptance instead returns a RequestErrorCode.

• OCO_SIBLING_FIRED: the paired stop-loss or take-profit fired and created its child order. The sibling is cancelled even when the child fills nothing. Cancelling a leg manually leaves its sibling armed; protection is not automatically re-armed.

• PROTECTIVE_SELF_TRADE_SWEEP: a resting maker order was cancelled to allow a protective stop to execute without self-trading. This reason appears on the maker's cancellation, unlike SELF_TRADE_PREVENTION, which cancels the incoming order.

• POSITION_CLOSED: no tradeable quantity remains to reduce. If the position has closed, reversed, or fallen below one lot before a stop fires, both protective legs are cancelled with triggered: false and no child is created. A fired child's remaining quantity is limited by the current reducible position; if that quantity is zero when it attempts to fill, its remainder is cancelled.

• RISK_REJECTED: the proposed protective child failed pre-trade risk checks. Both protective legs are cancelled with triggered: false; no child is created and protection is not automatically retried or re-armed.

A GTT stop or its resting child can be cancelled with GTT_EXPIRED before the signed expiresAfter to allow settlement. Explicit cancelAll includes fired children and reports MASS_CANCEL; cancel-all-after leaves armed protective stops and their fired children in place.

Create order

post

Create a new spot or perp order. timeInForce is required for every order class. STOP_LOSS and TAKE_PROFIT orders are supported only on perp markets. On trigger creates and modifications, omit reduceOnly and postOnly, including false. Supplied flags return INPUT_VALIDATION_ERROR. SDK signing and server verification reconstruct both as false; they never inherit stored values.

Armed stops. A protective stop is not executable liquidity until it fires. While armed, it remains modifiable and cancellable and appears as OPEN, with triggered: false in openOrders and walletOrderChanges. Order-history rows omit triggered; its absence there means unknown, not false.

Time in force and expiry. For a stop, timeInForce selects the fired child's behavior: IOC fills available liquidity and cancels the remainder; GTC rests the remainder until cancelled; GTT rests it until expiry. Only GTT carries expiresAfter, which must be in the future and strictly greater than the signature's deadline. GTC and IOC must omit it. Invalid combinations return INPUT_VALIDATION_ERROR or TRIGGER_IOC_MUST_NOT_EXPIRE_ERROR.

A GTT stop and its child share one absolute expiresAfter; firing does not start a new lifetime. The stop or resting child can be cancelled before that timestamp to allow settlement, with cancelReason: GTT_EXPIRED. Choose an expiry with sufficient time for both protection and settlement. An expiry that is too near returns ORDER_EXPIRES_TOO_SOON_ERROR. The signature's deadline controls request acceptance only; passing it does not disarm an accepted stop or prevent its child from executing. A fill that settles after expiresAfter can revert with OrderExpired.

Execution price. limitPx is the child's worst acceptable execution price, not an offset from triggerPx. It must be within the permitted range around triggerPx. TRIGGER_LIMIT_OUTSIDE_BAND_ERROR indicates an out-of-range limit or that stops are unavailable for the market. If the limit is out of range, move it closer to the trigger and re-sign; changing the price will not resolve market unavailability.

Firing and paired stops. When the mark price crosses triggerPx, the stop attempts to create its child. A created child has triggered: true and cancels the paired stop on the same account and market with OCO_SIBLING_FIRED, even if it fills nothing. A partial IOC fill can leave the remaining position without protection. Protection is not automatically re-armed. Manually cancelling one protective leg leaves its sibling armed. If a protective child would self-trade, the account's conflicting resting maker orders are cancelled with PROTECTIVE_SELF_TRADE_SWEEP so the child can execute.

If no tradeable position remains to reduce (the position closed, reversed, or is below one lot), both legs are cancelled with POSITION_CLOSED. If the proposed child fails pre-trade risk checks, both legs are cancelled with RISK_REJECTED. In either case, no child is created, both orders retain triggered: false, and protection is not automatically retried or re-armed. Use cancelReason for handling; do not parse cancelReasonMessage.

Resting children. Firing does not guarantee a fill. A GTC/GTT child can remain unfilled at limitPx if the market moves past it. Its fills cannot exceed the current reducible position, so displayed remaining quantity can exceed what can execute. A zero reducible quantity when it attempts to fill cancels the remainder with POSITION_CLOSED; closing the position by another route does not immediately remove the child. A fired child is cancel-only: modifyOrder is refused. Ordinary self-trade prevention applies to the account's new crossing orders. Explicit cancelAll includes the child; cancel-all-after leaves it in place.

Stops and their children only reduce positions, even though their signed reduceOnly field is false. They cannot open a new position.

Also available on the order-entry WebSocket (asyncapi-exec-v2.yaml, createOrder).

Responses and fill correlation

A created order receives an orderId, even if an IOC fills nothing and is immediately cancelled. execQty reports the fills from this request; cumQty reports lifetime fills. firstFillId and fillCount, when present, identify the contiguous fill range. All orders appear on orderChanges, with the same fill range when fills occur. See the Order Entry section's Cancellation reasons for cancelled outcomes. These fill-correlation rules also apply to modifyOrder responses.

Body

Create an order with an EIP-712 signature, nonce, and deadline. Field descriptions define signed values and order-class requirements. See POST /v2/createOrder for execution and protective-stop behavior.

exchangeIdintegerRequired

On-chain OrderDetails.exchangeId.

Example: 1

symbolstringRequired

Market symbol. The server resolves this to the on-chain OrderDetails.marketId, which uses a unified namespace: perp market ids are raw core ids, spot market ids are coreMarketId + 1e10.

Example: BTCRUSDPERPPattern: ^[A-Za-z0-9]+$

accountIdintegerRequired

On-chain OrderDetails.accountId.

Example: 12345

isBuybooleanRequired

Whether this is a buy order. Combined with qty, determines the signed OrderDetails.quantity (int256): positive for buy/long, negative for sell/short.

Example: true

limitPxstringRequired

Worst acceptable execution price. Must be positive (> 0). Maps to signed OrderDetails.limitPrice (uint256). For a STOP_LOSS/TAKE_PROFIT, this is the child's worst execution price, not an offset added to triggerPx. Keep it within the permitted range around the trigger price. TRIGGER_LIMIT_OUTSIDE_BAND_ERROR indicates an out-of-range price or that stops are unavailable for the market.

Example: 50000.0Pattern: ^-?\d+(\.\d+)?([eE][+-]?\d+)?$

qtystringOptional

Unsigned quantity, required for LIMIT orders; its sign in OrderDetails.quantity follows isBuy. Omit for STOP_LOSS/TAKE_PROFIT and sign the full-position sentinel ±int256.max (raw, not E18), with sign from isBuy. A protective stop takes its executable size from the position when it fires.

Example: 0.1Pattern: ^\d+(\.\d+)?([eE][+-]?\d+)?$

orderTypestring · enumRequired

On-chain OrderDetails.orderType: LIMIT, STOP_LOSS, or TAKE_PROFIT.

Example: LIMITPossible values:

timeInForcestring · enumRequired

Required signed OrderDetails.timeInForce (0 = GTC, 1 = IOC, 2 = GTT). For a protective stop, selects its fired child's time in force. Only GTT carries expiresAfter; GTC and IOC omit it. See POST /v2/createOrder for execution, expiry, and invalid-combination handling.

Example: GTCPossible values:

triggerPxstringOptional

Trigger price, required for STOP_LOSS/TAKE_PROFIT and omitted for LIMIT. Maps to on-chain OrderDetails.triggerPrice. The trigger fires when the market's mark price crosses this level; it is also the reference the limitPx band is measured from (see limitPx).

Example: 50000.0Pattern: ^-?\d+(\.\d+)?([eE][+-]?\d+)?$

reduceOnlybooleanOptional

Reduce-only intent. Required only for perp IOC orders. Omit this field for every other order class: perp GTC/GTT, STOP_LOSS/TAKE_PROFIT, and all spot orders. Sending the field, including false, for those order classes is rejected with INPUT_VALIDATION_ERROR. Omitted values map to false in the signed on-chain OrderDetails.reduceOnly field.

Example: false

postOnlybooleanOptional

Post-only (maker-only) intent for LIMIT GTC/GTT orders; rejected on IOC. Omit for STOP_LOSS/TAKE_PROFIT, including false: triggers sign OrderDetails.postOnly=false. A post-only LIMIT that would cross is rejected with POST_ONLY_WOULD_CROSS_ERROR.

Example: false

signaturestringRequired

EIP-712 signature over the Order(uint256 verifyingChainId, uint256 deadline, OrderDetails order) envelope. See the EIP-712 signing reference in the Reya docs (https://docs.reya.xyz/developers/readme/signatures-and-nonces) for the exact typehash string and signing algorithm.

Example: 0x1234...

noncestringRequired

Monotonically increasing per-signer nonce. Maps to on-chain OrderDetails.nonce.

Example: 1234567890

signerWalletstringRequired

Address of the signer that produced the EIP-712 signature. Maps to on-chain OrderDetails.signer.

Example: 0x6c51275fd01d5dbd2da194e92f920f8598306df2Pattern: ^0x[a-fA-F0-9]{40}$

deadlineintegerRequired

Unix seconds. Required EIP-712 signature-validity deadline, signed into the Order envelope. Requests received after this timestamp are rejected. It controls request acceptance only: once accepted, an order remains valid after deadline passes. An armed protective stop can still fire afterwards. Use expiresAfter to set GTT order lifetime.

Example: 1676923200

expiresAfterintegerOptional

GTT expiry in Unix seconds, signed as OrderDetails.expiresAfter. Required for GTT, in the future and strictly greater than deadline; omitted for GTC/IOC. A protective stop and its child share this expiry. See POST /v2/createOrder for early cancellation, settlement, and expiry errors.

Example: 1676923200

clientOrderIdstringOptional

Client-provided correlation ID, signed as OrderDetails.clientOrderId (uint64). Omit when unused; otherwise send a non-zero decimal string to preserve precision.

Example: 123456789

Other propertiesanyOptional

Responses

200

Order creation response

application/json

statusstring · enumRequired

OPEN includes partially filled resting orders, armed protective stops, and their resting children. FILLED and CANCELLED are terminal states. Use Order.triggered to distinguish armed stops from fired children. Requests rejected before order creation return errors, not order-status rows.

Possible values:

execQtystringOptional

Executed quantity in the current order update.

Example: 0.5Pattern: ^\d+(\.\d+)?([eE][+-]?\d+)?$

cumQtystringOptional

Total Executed quantity across all fills where the order is involved.

Example: 0.5Pattern: ^\d+(\.\d+)?([eE][+-]?\d+)?$

avgFillPxstringOptional

Quantity-weighted average execution price across all fills of the order so far (both maker and taker), excluding fees. Corresponds to cumQty, not execQty. Rounded half-up to at most 9 decimal places from exact cumulative executed notional. Preserved across amendments of the same order and cancellation. Exposed on create/modify responses, orderChanges, openOrders and orderHistory after the first fill; omitted when cumQty is zero.

Example: 3450.25Pattern: ^-?\d+(\.\d+)?([eE][+-]?\d+)?$

orderIdstringRequired

Reya-assigned order ID, generated for all order types including IOC. A no-cross IOC still receives an ID and is returned with status CANCELLED (it never rests).

Example: 490346525705109504

clientOrderIdstringOptional

Client-provided order ID echoed back from the request, as a decimal string (uint64).

Example: 123456789

cancelReasonstring · enumOptional

Machine-readable reason the order was cancelled. Present if and only if status is CANCELLED — e.g. a no-cross IOC returns status: CANCELLED with cancelReason: NO_LIQUIDITY, and a self-crossing IOC with SELF_TRADE_PREVENTION. Omitted entirely otherwise.

Possible values:

cancelReasonMessagestringOptional

Human-readable explanation of cancelReason. Present only when cancelReason is present.

Example: Order cancelled: no fillable liquidity available at the limit

firstFillIdstringOptional

First fill ID produced by this request. With fillCount, identifies [firstFillId, firstFillId + fillCount - 1]. Omitted if no fill occurred. See POST /v2/createOrder, Responses and fill correlation, for joining responses to streamed executions.

Example: 7205759403792794624

fillCountintegerOptional

Number of fills produced by this request, starting at firstFillId. Omitted if no fill occurred; positive whenever present.

Example: 2

Other propertiesanyOptional

400

Standardized error codes for API responses. Branch on error, not the free-text message or HTTP status. Every venue rejection on REST uses HTTP 400 with a RequestError body. The order-entry WebSocket returns the same code and optional retryAfterMs in its { ok: false, error } response. HTTP 429 is reserved for infrastructure-level (per-IP) limits in front of the API and is never a venue verdict.

Validation and authorization:

• INPUT_VALIDATION_ERROR: correct the request's fields or order-class combination before resubmitting. Immutable fields on a modify must match the existing order.
• SYMBOL_NOT_FOUND_ERROR, NO_ACCOUNTS_FOUND_ERROR: the requested market or account data is unavailable; check the request and current market/account state.
• NUMERIC_OVERFLOW_ERROR, PRICE_QTY_BOUNDS_ERROR: a numeric value is out of range, or price/quantity is invalid for the market. Check price increments and quantity limits.
• UNAUTHORIZED_SIGNATURE_ERROR: the signature is invalid or unauthorized. UNAUTHORIZED_ACCOUNT_ERROR: the signer is not permitted to act on the target order. For an armed protective stop, modify and cancel require the signer that created it.
• INVALID_NONCE_ERROR: use a fresh, monotonically increasing nonce for the signer and re-sign.
• ORDER_DEADLINE_PASSED_ERROR, ORDER_DEADLINE_TOO_HIGH_ERROR: the signature's deadline has passed or is too far in the future. Correct it and re-sign. This deadline controls request acceptance, not the lifetime of an accepted order.
• ORDER_EXPIRES_TOO_SOON_ERROR: a GTT order's expiresAfter leaves insufficient time for execution and settlement. Choose a later expiry and re-sign. GTT orders can be cancelled before their signed expiry to allow settlement; for a protective stop this applies to both its armed phase and its fired child.
• SERVICE_DISABLED_ERROR, TRADING_HALTED_ERROR: order entry is unavailable for the market. Check market availability before submitting again.
• DUPLICATE_CLIENT_ORDER_ID_ERROR: the client ID belongs to a live order. Reconcile that order before submitting another.
• ORDER_NOT_FOUND_ERROR: the target order was not found. Refresh its state before retrying.
• EMPTY_MODIFY_ERROR: a LIMIT modification makes no change. An armed trigger may be re-signed at unchanged prices.
• MODIFY_QTY_BELOW_FILLED_ERROR: the modified total quantity must exceed the quantity already filled.
• POST_ONLY_WOULD_CROSS_ERROR: the order would execute immediately. Choose a non-crossing price or change the post-only intent and re-sign.
• The *_OTHER_ERROR codes are operation-specific failures without a more specific code. Use message for display or troubleshooting; do not parse it as a stable machine-readable contract.

Pre-trade risk checks:

• ACCOUNT_BELOW_LIQUIDATION_MARGIN_ERROR: the account does not meet the required liquidation-margin or balance conditions.
• ACCOUNT_BELOW_INITIAL_MARGIN_ERROR: the proposed trade does not meet the account's initial-margin or collateral requirements. An account already below initial margin may trade only when the trade improves its health.
• INSUFFICIENT_BALANCE_ERROR: the account cannot fund the order.
• OPEN_INTEREST_CAP_ERROR, OPEN_INTEREST_BUDGET_ERROR: the trade exceeds the market's available open-interest capacity.
• REDUCE_ONLY_CONDITION_NOT_MET_ERROR: the order would not strictly reduce the current position, for example because there is no position, the side is wrong, or the size would reverse it.

A request refused by risk checks is rejected in full. A rejected create produces no order; a rejected modify leaves the existing order unchanged. These failures require a change in account or market state, a smaller order, more collateral, or a user decision; do not automatically retry them unchanged. Resting-order cancellations appear separately as cancelReason: RISK_CANCELLED. A protective stop whose child fails risk checks is cancelled with RISK_REJECTED; see CancelReason.

Protective stops:

• TRIGGER_IOC_MUST_NOT_EXPIRE_ERROR: an IOC trigger cannot carry expiresAfter. Only GTT orders carry an expiry; GTC and IOC must omit it. Invalid time-in-force/expiry combinations can also return INPUT_VALIDATION_ERROR. Correct the combination and re-sign.
• TRIGGER_LIMIT_OUTSIDE_BAND_ERROR: the stop's limitPx is outside the permitted range around triggerPx, or stops are unavailable for the market. Move the limit closer to the trigger and re-sign when the price is out of range. If the message indicates stops are unavailable, changing the price will not resolve it.
• TRIGGER_ALREADY_EXISTS_ERROR: the account already has an armed stop of the same type on that market. At most one stop-loss and one take-profit may be armed per account and market. Modify or cancel the existing stop before replacing it.

Rate limits and resting-order caps:

• RATE_LIMITED_ERROR: the account's request budget for this operation is exhausted. Create and modify share a placement budget; single cancels, bulk cancels, and cancel-all-after control have separate budgets. Budgets are shared across markets, signers, REST, and WebSocket requests for the same account. Wait at least retryAfterMs milliseconds before retrying. This is a minimum wait, not a reserved request slot; concurrent traffic can use the available budget. Disarming an armed cancel-all-after countdown is never throttled. A disarm when no countdown is armed can be throttled.
• OPEN_ORDER_COUNT_EXCEEDED_ERROR: a new resting order would exceed the account's total or per-market resting-order count. Cancel orders or allow them to fill before placing more. Modifications do not increase the count.
• OPEN_ORDER_NOTIONAL_EXCEEDED_ERROR: the account's combined resting-order notional would exceed its limit. Notional is remaining quantity multiplied by limit price for resting GTC/GTT orders. Creates are checked against the submitted quantity before any immediate fills; modifications are checked against the resulting notional. IOC orders and armed triggers are exempt; fired trigger children that rest count toward the limits. Cancel or shrink resting orders, or submit a smaller order.

Resting-order cap errors carry no retryAfterMs: waiting alone does not resolve them. CAPACITY_LIMITED_ERROR means the venue temporarily cannot accept a create or modify. It carries no retry hint; use backoff with jitter. Cancels and cancel-all-after operations are not refused for venue capacity, though their separate account rate limits still apply.

Temporary availability:

• CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR: an order that would execute immediately cannot currently pass the required pre-trade checks. Retry after a short delay. Existing resting orders remain in place; non-crossing orders and cancellations remain available.
• SERVICE_UNAVAILABLE_ERROR: the request was not accepted. Account-owner, signature or permission checks were unavailable before dispatch, or the transport did not send the request (including a full outbound queue). Re-sign with a fresh nonce and resubmit, retaining the same clientOrderId when supplied. Back off while the service remains unavailable. An unchanged nonce may already be below the signer's nonce floor because a later request was accepted.
• ORDER_OUTCOME_UNKNOWN_ERROR: the transport failed after the request may have reached the matching engine. The operation may have been applied. Reconcile open orders and executions before resubmitting; never replace an unresolved attempt with a fresh nonce. Retain the complete signed request, including operation, account, market/filter scope, nonce, and order identifiers. Responses do not provide an acceptance receipt or an outcome-query mechanism. Absence from open orders is not proof of failure: the order may have filled, and read data can lag. Executions correlate by order/fill IDs, not request nonces. Insufficient or ambiguous evidence remains unresolved. For cancelAllAfter, open orders do not establish whether a timer was armed, refreshed, or disarmed.

Permission errors such as NOT_WHITELISTED_ERROR and ACCOUNT_SUSPENDED_ERROR are not resolved by automatic retries. Contact support if an expected operation is refused.

Retry policy: retry unchanged after a short delay for CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR; re-sign with a fresh nonce for SERVICE_UNAVAILABLE_ERROR; reconcile first for ORDER_OUTCOME_UNKNOWN_ERROR; retry RATE_LIMITED_ERROR after at least retryAfterMs; retry CAPACITY_LIMITED_ERROR using backoff with jitter. Correct validation failures and re-sign where required. Reconcile order state before retrying an unanswered request, because a transport timeout or disconnect does not establish that the request was rejected.

application/json

500

Internal server error

application/json

post/createOrder

POST /v2/createOrder HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 418

{
  "exchangeId": 1,
  "symbol": "BTCRUSDPERP",
  "accountId": 12345,
  "isBuy": true,
  "limitPx": "50000.0",
  "qty": "0.1",
  "orderType": "LIMIT",
  "timeInForce": "GTC",
  "triggerPx": "50000.0",
  "reduceOnly": false,
  "postOnly": false,
  "signature": "0x1234...",
  "nonce": "1234567890",
  "signerWallet": "0x6c51275fd01d5dbd2da194e92f920f8598306df2",
  "deadline": 1676923200,
  "expiresAfter": 1676923200,
  "clientOrderId": "123456789",
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "status": "OPEN",
  "execQty": "0.5",
  "cumQty": "0.5",
  "avgFillPx": "3450.25",
  "orderId": "490346525705109504",
  "clientOrderId": "123456789",
  "cancelReason": "NO_LIQUIDITY",
  "cancelReasonMessage": "Order cancelled: no fillable liquidity available at the limit",
  "firstFillId": "7205759403792794624",
  "fillCount": 2,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Modify order

post

Modify a resting order in place, preserving its orderId and clientOrderId. The same rules apply to the order-entry WebSocket modifyOrder operation.

Target and signature

• Target by orderId, or a non-zero clientOrderId if orderId is absent.

• If both are supplied, orderId selects the order and clientOrderId must match its existing client ID. Omit clientOrderId if the order has none.

• Send the complete intended post-modify OrderDetails, including unchanged values, except the fixed trigger flags described below. Omitted fields do not inherit the resting order's values.

• Sign the restated fields with a fresh EIP-712 signature and nonce, using the same Order / OrderDetails envelope as createOrder.

Fields that can change

Order class	Modifiable fields	Requirements
LIMIT	limitPx, qty, postOnly, expiresAfter	Omit triggerPx. Send total qty, strictly greater than cumQty; otherwise MODIFY_QTY_BELOW_FILLED_ERROR.
Armed STOP_LOSS / TAKE_PROFIT	limitPx, triggerPx	Send triggerPx; omit qty and sign the full-position sentinel ±int256.max, with sign from isBuy. Omit reduceOnly and postOnly; sign both as false. Supplied flags, including false, are rejected.

exchangeId, isBuy, orderType, timeInForce, clientOrderId, accountId, and signerWallet must match the existing order. LIMIT modifies also restate reduceOnly; triggers reconstruct reduceOnly=false and postOnly=false before signature verification and engine submission. A mismatch returns INPUT_VALIDATION_ERROR. For all order classes, omit expiresAfter for GTC/IOC; GTT requires a future expiry strictly greater than deadline.

Only armed stops (triggered: false) can be modified; fired children are cancel-only. A stop's timeInForce and shared expiresAfter cannot change: cancel and recreate it to change either. Its post-modify limitPx and triggerPx must satisfy the market's trigger-price band, or the request returns TRIGGER_LIMIT_OUTSIDE_BAND_ERROR.

Priority and execution

• Decreasing qty at unchanged limitPx preserves queue priority. Increasing qty or changing limitPx loses priority.

• An unchanged LIMIT request returns EMPTY_MODIFY_ERROR. An armed stop may be re-signed with a fresh signature, nonce, and deadline at unchanged prices.

• A post-only modification that would cross returns POST_ONLY_WOULD_CROSS_ERROR and leaves the order unchanged. A non-post-only crossing modification can execute immediately; the response reports execQty and status.

• Per-fill details are delivered on the execution and order-change streams.

A crossing modification reports OPEN if a partially filled remainder rests, or FILLED if fully executed. If it would self-trade against the account's resting liquidity, the incoming modified order is cancelled with SELF_TRADE_PREVENTION; any completed fills remain recorded. See POST /v2/createOrder, Responses and fill correlation, to associate response fill IDs with streamed executions.

Body

Modify a resting order using its complete intended post-modify state and a fresh signature and nonce. Omitted fields do not inherit existing values. Target by orderId or a non-zero clientOrderId. See POST /v2/modifyOrder for modifiable fields, priority, and execution behavior.

or

Responses

200

Order modification response

application/json

Result of a modification, with the same orderId as before. Fields report immediate execution and resulting order state. See POST /v2/modifyOrder for outcomes and POST /v2/createOrder for shared fill-correlation rules.

statusstring · enumRequired

OPEN includes partially filled resting orders, armed protective stops, and their resting children. FILLED and CANCELLED are terminal states. Use Order.triggered to distinguish armed stops from fired children. Requests rejected before order creation return errors, not order-status rows.

Possible values:

execQtystringOptional

Quantity filled immediately by this modification. Present only when the modification crossed and executed.

Example: 0.5Pattern: ^\d+(\.\d+)?([eE][+-]?\d+)?$

cumQtystringOptional

Total executed quantity across the order's lifetime, including fills from before the modification.

Example: 0.5Pattern: ^\d+(\.\d+)?([eE][+-]?\d+)?$

avgFillPxstringOptional

Quantity-weighted average execution price across all fills of the order so far (both maker and taker), excluding fees. Corresponds to cumQty, not execQty. Rounded half-up to at most 9 decimal places from exact cumulative executed notional. Preserved across amendments of the same order and cancellation. Exposed on create/modify responses, orderChanges, openOrders and orderHistory after the first fill; omitted when cumQty is zero.

Example: 3450.25Pattern: ^-?\d+(\.\d+)?([eE][+-]?\d+)?$

orderIdstringRequired

Order ID — unchanged by the modification (the same ID the order had before).

Example: 490346525705109504

clientOrderIdstringOptional

Client-provided order ID preserved from order creation, as a decimal string (uint64).

Example: 123456789

cancelReasonstring · enumOptional

Machine-readable reason the modified order was cancelled. Present if and only if status is CANCELLED — for a self-crossing non-post-only modify this is SELF_TRADE_PREVENTION. Omitted entirely otherwise.

Possible values:

cancelReasonMessagestringOptional

Human-readable explanation of cancelReason. Present only when cancelReason is present.

Example: Order cancelled because it would have matched your own resting order

firstFillIdstringOptional

First fill ID produced by this request. With fillCount, identifies [firstFillId, firstFillId + fillCount - 1]. Omitted if no fill occurred. See POST /v2/createOrder, Responses and fill correlation, for joining responses to streamed executions.

Example: 7205759403792794624

fillCountintegerOptional

Number of fills produced by this request, starting at firstFillId. Omitted if no fill occurred; positive whenever present.

Example: 2

Other propertiesanyOptional

400

Standardized error codes for API responses. Branch on error, not the free-text message or HTTP status. Every venue rejection on REST uses HTTP 400 with a RequestError body. The order-entry WebSocket returns the same code and optional retryAfterMs in its { ok: false, error } response. HTTP 429 is reserved for infrastructure-level (per-IP) limits in front of the API and is never a venue verdict.

Validation and authorization:

• INPUT_VALIDATION_ERROR: correct the request's fields or order-class combination before resubmitting. Immutable fields on a modify must match the existing order.
• SYMBOL_NOT_FOUND_ERROR, NO_ACCOUNTS_FOUND_ERROR: the requested market or account data is unavailable; check the request and current market/account state.
• NUMERIC_OVERFLOW_ERROR, PRICE_QTY_BOUNDS_ERROR: a numeric value is out of range, or price/quantity is invalid for the market. Check price increments and quantity limits.
• UNAUTHORIZED_SIGNATURE_ERROR: the signature is invalid or unauthorized. UNAUTHORIZED_ACCOUNT_ERROR: the signer is not permitted to act on the target order. For an armed protective stop, modify and cancel require the signer that created it.
• INVALID_NONCE_ERROR: use a fresh, monotonically increasing nonce for the signer and re-sign.
• ORDER_DEADLINE_PASSED_ERROR, ORDER_DEADLINE_TOO_HIGH_ERROR: the signature's deadline has passed or is too far in the future. Correct it and re-sign. This deadline controls request acceptance, not the lifetime of an accepted order.
• ORDER_EXPIRES_TOO_SOON_ERROR: a GTT order's expiresAfter leaves insufficient time for execution and settlement. Choose a later expiry and re-sign. GTT orders can be cancelled before their signed expiry to allow settlement; for a protective stop this applies to both its armed phase and its fired child.
• SERVICE_DISABLED_ERROR, TRADING_HALTED_ERROR: order entry is unavailable for the market. Check market availability before submitting again.
• DUPLICATE_CLIENT_ORDER_ID_ERROR: the client ID belongs to a live order. Reconcile that order before submitting another.
• ORDER_NOT_FOUND_ERROR: the target order was not found. Refresh its state before retrying.
• EMPTY_MODIFY_ERROR: a LIMIT modification makes no change. An armed trigger may be re-signed at unchanged prices.
• MODIFY_QTY_BELOW_FILLED_ERROR: the modified total quantity must exceed the quantity already filled.
• POST_ONLY_WOULD_CROSS_ERROR: the order would execute immediately. Choose a non-crossing price or change the post-only intent and re-sign.
• The *_OTHER_ERROR codes are operation-specific failures without a more specific code. Use message for display or troubleshooting; do not parse it as a stable machine-readable contract.

Pre-trade risk checks:

• ACCOUNT_BELOW_LIQUIDATION_MARGIN_ERROR: the account does not meet the required liquidation-margin or balance conditions.
• ACCOUNT_BELOW_INITIAL_MARGIN_ERROR: the proposed trade does not meet the account's initial-margin or collateral requirements. An account already below initial margin may trade only when the trade improves its health.
• INSUFFICIENT_BALANCE_ERROR: the account cannot fund the order.
• OPEN_INTEREST_CAP_ERROR, OPEN_INTEREST_BUDGET_ERROR: the trade exceeds the market's available open-interest capacity.
• REDUCE_ONLY_CONDITION_NOT_MET_ERROR: the order would not strictly reduce the current position, for example because there is no position, the side is wrong, or the size would reverse it.

A request refused by risk checks is rejected in full. A rejected create produces no order; a rejected modify leaves the existing order unchanged. These failures require a change in account or market state, a smaller order, more collateral, or a user decision; do not automatically retry them unchanged. Resting-order cancellations appear separately as cancelReason: RISK_CANCELLED. A protective stop whose child fails risk checks is cancelled with RISK_REJECTED; see CancelReason.

Protective stops:

• TRIGGER_IOC_MUST_NOT_EXPIRE_ERROR: an IOC trigger cannot carry expiresAfter. Only GTT orders carry an expiry; GTC and IOC must omit it. Invalid time-in-force/expiry combinations can also return INPUT_VALIDATION_ERROR. Correct the combination and re-sign.
• TRIGGER_LIMIT_OUTSIDE_BAND_ERROR: the stop's limitPx is outside the permitted range around triggerPx, or stops are unavailable for the market. Move the limit closer to the trigger and re-sign when the price is out of range. If the message indicates stops are unavailable, changing the price will not resolve it.
• TRIGGER_ALREADY_EXISTS_ERROR: the account already has an armed stop of the same type on that market. At most one stop-loss and one take-profit may be armed per account and market. Modify or cancel the existing stop before replacing it.

Rate limits and resting-order caps:

• RATE_LIMITED_ERROR: the account's request budget for this operation is exhausted. Create and modify share a placement budget; single cancels, bulk cancels, and cancel-all-after control have separate budgets. Budgets are shared across markets, signers, REST, and WebSocket requests for the same account. Wait at least retryAfterMs milliseconds before retrying. This is a minimum wait, not a reserved request slot; concurrent traffic can use the available budget. Disarming an armed cancel-all-after countdown is never throttled. A disarm when no countdown is armed can be throttled.
• OPEN_ORDER_COUNT_EXCEEDED_ERROR: a new resting order would exceed the account's total or per-market resting-order count. Cancel orders or allow them to fill before placing more. Modifications do not increase the count.
• OPEN_ORDER_NOTIONAL_EXCEEDED_ERROR: the account's combined resting-order notional would exceed its limit. Notional is remaining quantity multiplied by limit price for resting GTC/GTT orders. Creates are checked against the submitted quantity before any immediate fills; modifications are checked against the resulting notional. IOC orders and armed triggers are exempt; fired trigger children that rest count toward the limits. Cancel or shrink resting orders, or submit a smaller order.

Resting-order cap errors carry no retryAfterMs: waiting alone does not resolve them. CAPACITY_LIMITED_ERROR means the venue temporarily cannot accept a create or modify. It carries no retry hint; use backoff with jitter. Cancels and cancel-all-after operations are not refused for venue capacity, though their separate account rate limits still apply.

Temporary availability:

• CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR: an order that would execute immediately cannot currently pass the required pre-trade checks. Retry after a short delay. Existing resting orders remain in place; non-crossing orders and cancellations remain available.
• SERVICE_UNAVAILABLE_ERROR: the request was not accepted. Account-owner, signature or permission checks were unavailable before dispatch, or the transport did not send the request (including a full outbound queue). Re-sign with a fresh nonce and resubmit, retaining the same clientOrderId when supplied. Back off while the service remains unavailable. An unchanged nonce may already be below the signer's nonce floor because a later request was accepted.
• ORDER_OUTCOME_UNKNOWN_ERROR: the transport failed after the request may have reached the matching engine. The operation may have been applied. Reconcile open orders and executions before resubmitting; never replace an unresolved attempt with a fresh nonce. Retain the complete signed request, including operation, account, market/filter scope, nonce, and order identifiers. Responses do not provide an acceptance receipt or an outcome-query mechanism. Absence from open orders is not proof of failure: the order may have filled, and read data can lag. Executions correlate by order/fill IDs, not request nonces. Insufficient or ambiguous evidence remains unresolved. For cancelAllAfter, open orders do not establish whether a timer was armed, refreshed, or disarmed.

Permission errors such as NOT_WHITELISTED_ERROR and ACCOUNT_SUSPENDED_ERROR are not resolved by automatic retries. Contact support if an expected operation is refused.

Retry policy: retry unchanged after a short delay for CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR; re-sign with a fresh nonce for SERVICE_UNAVAILABLE_ERROR; reconcile first for ORDER_OUTCOME_UNKNOWN_ERROR; retry RATE_LIMITED_ERROR after at least retryAfterMs; retry CAPACITY_LIMITED_ERROR using backoff with jitter. Correct validation failures and re-sign where required. Reconcile order state before retrying an unanswered request, because a transport timeout or disconnect does not establish that the request was rejected.

application/json

500

Internal server error

application/json

post/modifyOrder

POST /v2/modifyOrder HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 449

{
  "orderId": "490346525705109504",
  "clientOrderId": "123456789",
  "symbol": "BTCRUSDPERP",
  "accountId": 12345,
  "exchangeId": 1,
  "isBuy": true,
  "timeInForce": "GTC",
  "triggerPx": "49000.0",
  "limitPx": "50000.0",
  "qty": "0.1",
  "expiresAfter": 1676923200,
  "signature": "0x1234...",
  "nonce": "1234567890",
  "signerWallet": "0x6c51275fd01d5dbd2da194e92f920f8598306df2",
  "deadline": 1676923200,
  "ANY_ADDITIONAL_PROPERTY": "anything",
  "orderType": "LIMIT",
  "reduceOnly": false,
  "postOnly": false
}

{
  "status": "OPEN",
  "execQty": "0.5",
  "cumQty": "0.5",
  "avgFillPx": "3450.25",
  "orderId": "490346525705109504",
  "clientOrderId": "123456789",
  "cancelReason": "NO_LIQUIDITY",
  "cancelReasonMessage": "Order cancelled because it would have matched your own resting order",
  "firstFillId": "7205759403792794624",
  "fillCount": 2,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Cancel order

post

Cancel an existing order. Supports spot, perp, and protective stop orders. accountId, nonce, and deadline are required and bound into the EIP-712 signature.

For a STOP_LOSS / TAKE_PROFIT, cancellation is bound to the arming signer: the wallet that signs this cancel must be the exact wallet that armed the trigger, so a different signer holding trade permission on the same account cannot cancel it and is rejected with UNAUTHORIZED_ACCOUNT_ERROR. The same binding applies to modifyOrder on an armed trigger.

Also available on the order-entry WebSocket (asyncapi-exec-v2.yaml, cancelOrder).

Body

Cancel a live order by orderId, or a non-zero clientOrderId when orderId is absent. Supports spot, perp, and protective stops. See POST /v2/cancelOrder for signer requirements.

orderIdstringOptional

Reya-assigned order ID to cancel, as returned by CreateOrderResponse. Provide orderId, or a non-zero clientOrderId when orderId is absent. If both are supplied, orderId takes precedence and clientOrderId is ignored.

Example: 490346525705109504

clientOrderIdstringOptional

Client-provided order ID for tracking and correlation, as a decimal string (uint64). Used as the lookup key only when orderId is absent, and then it must be non-zero. This is the same clientOrderId provided in CreateOrderRequest.

Example: 123456789

accountIdintegerRequired

Account ID that owns the order.

Example: 12345

symbolstringRequired

Market symbol for the order.

Example: BTCRUSDPERPPattern: ^[A-Za-z0-9]+$

signaturestringRequired

EIP-712 signature over the OrderCancel(uint64 verifyingChainId, uint64 deadline, OrderCancelDetails cancel) envelope. See the EIP-712 signing reference in the Reya docs (https://docs.reya.xyz/developers/readme/signatures-and-nonces) for the exact typehash string and signing algorithm.

Example: 0x5678...

noncestringRequired

Monotonically increasing per-signer nonce. A fresh nonce is required per request; replayed nonces are rejected with INVALID_NONCE_ERROR. See the EIP-712 signing reference in the Reya docs (https://docs.reya.xyz/developers/readme/signatures-and-nonces).

Example: 1234567890

deadlineintegerRequired

Unix seconds. Signature-validity deadline signed into the OrderCancel envelope. Requests received after this timestamp are rejected.

Example: 1676923200

Other propertiesanyOptional

Responses

200

Order cancellation response

application/json

statusstring · enumRequired

OPEN includes partially filled resting orders, armed protective stops, and their resting children. FILLED and CANCELLED are terminal states. Use Order.triggered to distinguish armed stops from fired children. Requests rejected before order creation return errors, not order-status rows.

Possible values:

orderIdstringRequired

Cancelled order ID

Example: 490346525705109504

clientOrderIdstringOptional

Client-provided order ID echoed back from the request, as a decimal string (uint64).

Example: 123456789

Other propertiesanyOptional

400

Standardized error codes for API responses. Branch on error, not the free-text message or HTTP status. Every venue rejection on REST uses HTTP 400 with a RequestError body. The order-entry WebSocket returns the same code and optional retryAfterMs in its { ok: false, error } response. HTTP 429 is reserved for infrastructure-level (per-IP) limits in front of the API and is never a venue verdict.

Validation and authorization:

• INPUT_VALIDATION_ERROR: correct the request's fields or order-class combination before resubmitting. Immutable fields on a modify must match the existing order.
• SYMBOL_NOT_FOUND_ERROR, NO_ACCOUNTS_FOUND_ERROR: the requested market or account data is unavailable; check the request and current market/account state.
• NUMERIC_OVERFLOW_ERROR, PRICE_QTY_BOUNDS_ERROR: a numeric value is out of range, or price/quantity is invalid for the market. Check price increments and quantity limits.
• UNAUTHORIZED_SIGNATURE_ERROR: the signature is invalid or unauthorized. UNAUTHORIZED_ACCOUNT_ERROR: the signer is not permitted to act on the target order. For an armed protective stop, modify and cancel require the signer that created it.
• INVALID_NONCE_ERROR: use a fresh, monotonically increasing nonce for the signer and re-sign.
• ORDER_DEADLINE_PASSED_ERROR, ORDER_DEADLINE_TOO_HIGH_ERROR: the signature's deadline has passed or is too far in the future. Correct it and re-sign. This deadline controls request acceptance, not the lifetime of an accepted order.
• ORDER_EXPIRES_TOO_SOON_ERROR: a GTT order's expiresAfter leaves insufficient time for execution and settlement. Choose a later expiry and re-sign. GTT orders can be cancelled before their signed expiry to allow settlement; for a protective stop this applies to both its armed phase and its fired child.
• SERVICE_DISABLED_ERROR, TRADING_HALTED_ERROR: order entry is unavailable for the market. Check market availability before submitting again.
• DUPLICATE_CLIENT_ORDER_ID_ERROR: the client ID belongs to a live order. Reconcile that order before submitting another.
• ORDER_NOT_FOUND_ERROR: the target order was not found. Refresh its state before retrying.
• EMPTY_MODIFY_ERROR: a LIMIT modification makes no change. An armed trigger may be re-signed at unchanged prices.
• MODIFY_QTY_BELOW_FILLED_ERROR: the modified total quantity must exceed the quantity already filled.
• POST_ONLY_WOULD_CROSS_ERROR: the order would execute immediately. Choose a non-crossing price or change the post-only intent and re-sign.
• The *_OTHER_ERROR codes are operation-specific failures without a more specific code. Use message for display or troubleshooting; do not parse it as a stable machine-readable contract.

Pre-trade risk checks:

• ACCOUNT_BELOW_LIQUIDATION_MARGIN_ERROR: the account does not meet the required liquidation-margin or balance conditions.
• ACCOUNT_BELOW_INITIAL_MARGIN_ERROR: the proposed trade does not meet the account's initial-margin or collateral requirements. An account already below initial margin may trade only when the trade improves its health.
• INSUFFICIENT_BALANCE_ERROR: the account cannot fund the order.
• OPEN_INTEREST_CAP_ERROR, OPEN_INTEREST_BUDGET_ERROR: the trade exceeds the market's available open-interest capacity.
• REDUCE_ONLY_CONDITION_NOT_MET_ERROR: the order would not strictly reduce the current position, for example because there is no position, the side is wrong, or the size would reverse it.

A request refused by risk checks is rejected in full. A rejected create produces no order; a rejected modify leaves the existing order unchanged. These failures require a change in account or market state, a smaller order, more collateral, or a user decision; do not automatically retry them unchanged. Resting-order cancellations appear separately as cancelReason: RISK_CANCELLED. A protective stop whose child fails risk checks is cancelled with RISK_REJECTED; see CancelReason.

Protective stops:

• TRIGGER_IOC_MUST_NOT_EXPIRE_ERROR: an IOC trigger cannot carry expiresAfter. Only GTT orders carry an expiry; GTC and IOC must omit it. Invalid time-in-force/expiry combinations can also return INPUT_VALIDATION_ERROR. Correct the combination and re-sign.
• TRIGGER_LIMIT_OUTSIDE_BAND_ERROR: the stop's limitPx is outside the permitted range around triggerPx, or stops are unavailable for the market. Move the limit closer to the trigger and re-sign when the price is out of range. If the message indicates stops are unavailable, changing the price will not resolve it.
• TRIGGER_ALREADY_EXISTS_ERROR: the account already has an armed stop of the same type on that market. At most one stop-loss and one take-profit may be armed per account and market. Modify or cancel the existing stop before replacing it.

Rate limits and resting-order caps:

• RATE_LIMITED_ERROR: the account's request budget for this operation is exhausted. Create and modify share a placement budget; single cancels, bulk cancels, and cancel-all-after control have separate budgets. Budgets are shared across markets, signers, REST, and WebSocket requests for the same account. Wait at least retryAfterMs milliseconds before retrying. This is a minimum wait, not a reserved request slot; concurrent traffic can use the available budget. Disarming an armed cancel-all-after countdown is never throttled. A disarm when no countdown is armed can be throttled.
• OPEN_ORDER_COUNT_EXCEEDED_ERROR: a new resting order would exceed the account's total or per-market resting-order count. Cancel orders or allow them to fill before placing more. Modifications do not increase the count.
• OPEN_ORDER_NOTIONAL_EXCEEDED_ERROR: the account's combined resting-order notional would exceed its limit. Notional is remaining quantity multiplied by limit price for resting GTC/GTT orders. Creates are checked against the submitted quantity before any immediate fills; modifications are checked against the resulting notional. IOC orders and armed triggers are exempt; fired trigger children that rest count toward the limits. Cancel or shrink resting orders, or submit a smaller order.

Resting-order cap errors carry no retryAfterMs: waiting alone does not resolve them. CAPACITY_LIMITED_ERROR means the venue temporarily cannot accept a create or modify. It carries no retry hint; use backoff with jitter. Cancels and cancel-all-after operations are not refused for venue capacity, though their separate account rate limits still apply.

Temporary availability:

• CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR: an order that would execute immediately cannot currently pass the required pre-trade checks. Retry after a short delay. Existing resting orders remain in place; non-crossing orders and cancellations remain available.
• SERVICE_UNAVAILABLE_ERROR: the request was not accepted. Account-owner, signature or permission checks were unavailable before dispatch, or the transport did not send the request (including a full outbound queue). Re-sign with a fresh nonce and resubmit, retaining the same clientOrderId when supplied. Back off while the service remains unavailable. An unchanged nonce may already be below the signer's nonce floor because a later request was accepted.
• ORDER_OUTCOME_UNKNOWN_ERROR: the transport failed after the request may have reached the matching engine. The operation may have been applied. Reconcile open orders and executions before resubmitting; never replace an unresolved attempt with a fresh nonce. Retain the complete signed request, including operation, account, market/filter scope, nonce, and order identifiers. Responses do not provide an acceptance receipt or an outcome-query mechanism. Absence from open orders is not proof of failure: the order may have filled, and read data can lag. Executions correlate by order/fill IDs, not request nonces. Insufficient or ambiguous evidence remains unresolved. For cancelAllAfter, open orders do not establish whether a timer was armed, refreshed, or disarmed.

Permission errors such as NOT_WHITELISTED_ERROR and ACCOUNT_SUSPENDED_ERROR are not resolved by automatic retries. Contact support if an expected operation is refused.

Retry policy: retry unchanged after a short delay for CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR; re-sign with a fresh nonce for SERVICE_UNAVAILABLE_ERROR; reconcile first for ORDER_OUTCOME_UNKNOWN_ERROR; retry RATE_LIMITED_ERROR after at least retryAfterMs; retry CAPACITY_LIMITED_ERROR using backoff with jitter. Correct validation failures and re-sign where required. Reconcile order state before retrying an unanswered request, because a transport timeout or disconnect does not establish that the request was rejected.

application/json

500

Internal server error

application/json

post/cancelOrder

POST /v2/cancelOrder HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 205

{
  "orderId": "490346525705109504",
  "clientOrderId": "123456789",
  "accountId": 12345,
  "symbol": "BTCRUSDPERP",
  "signature": "0x5678...",
  "nonce": "1234567890",
  "deadline": 1676923200,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "status": "OPEN",
  "orderId": "490346525705109504",
  "clientOrderId": "123456789",
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Cancel all orders

post

Cancel all open orders for an account, optionally restricted by symbol. Omit symbol to cancel across the account's markets. Supports spot and perp markets and includes protective stops and their fired children. Also available on the order-entry WebSocket as cancelAll; the same filters and signing requirements apply.

Body

Request to cancel all orders matching the specified filters

accountIdintegerRequired

Account ID to cancel orders for.

Example: 12345

symbolstringOptional

Symbol to cancel orders for. If not specified, cancels orders for all symbols.

Example: BTCRUSDPERPPattern: ^[A-Za-z0-9]+$

signaturestringRequired

EIP-712 signature over the MassCancel(uint64 verifyingChainId, uint64 deadline, MassCancelDetails massCancel) envelope. See the EIP-712 signing reference in the Reya docs (https://docs.reya.xyz/developers/readme/signatures-and-nonces) for the exact typehash string and signing algorithm.

Example: 0x1234...

noncestringRequired

Monotonically increasing per-signer nonce. A fresh nonce is required per request; replayed nonces are rejected with INVALID_NONCE_ERROR. See the EIP-712 signing reference in the Reya docs (https://docs.reya.xyz/developers/readme/signatures-and-nonces).

Example: 1234567890

deadlineintegerRequired

Unix seconds. Signature-validity deadline signed into the MassCancel envelope. Requests received after this timestamp are rejected.

Example: 1676923200

Other propertiesanyOptional

Responses

200

Mass cancel response

application/json

cancelledCountintegerRequired

Number of orders that were cancelled

Example: 5

Other propertiesanyOptional

400

Standardized error codes for API responses. Branch on error, not the free-text message or HTTP status. Every venue rejection on REST uses HTTP 400 with a RequestError body. The order-entry WebSocket returns the same code and optional retryAfterMs in its { ok: false, error } response. HTTP 429 is reserved for infrastructure-level (per-IP) limits in front of the API and is never a venue verdict.

Validation and authorization:

• INPUT_VALIDATION_ERROR: correct the request's fields or order-class combination before resubmitting. Immutable fields on a modify must match the existing order.
• SYMBOL_NOT_FOUND_ERROR, NO_ACCOUNTS_FOUND_ERROR: the requested market or account data is unavailable; check the request and current market/account state.
• NUMERIC_OVERFLOW_ERROR, PRICE_QTY_BOUNDS_ERROR: a numeric value is out of range, or price/quantity is invalid for the market. Check price increments and quantity limits.
• UNAUTHORIZED_SIGNATURE_ERROR: the signature is invalid or unauthorized. UNAUTHORIZED_ACCOUNT_ERROR: the signer is not permitted to act on the target order. For an armed protective stop, modify and cancel require the signer that created it.
• INVALID_NONCE_ERROR: use a fresh, monotonically increasing nonce for the signer and re-sign.
• ORDER_DEADLINE_PASSED_ERROR, ORDER_DEADLINE_TOO_HIGH_ERROR: the signature's deadline has passed or is too far in the future. Correct it and re-sign. This deadline controls request acceptance, not the lifetime of an accepted order.
• ORDER_EXPIRES_TOO_SOON_ERROR: a GTT order's expiresAfter leaves insufficient time for execution and settlement. Choose a later expiry and re-sign. GTT orders can be cancelled before their signed expiry to allow settlement; for a protective stop this applies to both its armed phase and its fired child.
• SERVICE_DISABLED_ERROR, TRADING_HALTED_ERROR: order entry is unavailable for the market. Check market availability before submitting again.
• DUPLICATE_CLIENT_ORDER_ID_ERROR: the client ID belongs to a live order. Reconcile that order before submitting another.
• ORDER_NOT_FOUND_ERROR: the target order was not found. Refresh its state before retrying.
• EMPTY_MODIFY_ERROR: a LIMIT modification makes no change. An armed trigger may be re-signed at unchanged prices.
• MODIFY_QTY_BELOW_FILLED_ERROR: the modified total quantity must exceed the quantity already filled.
• POST_ONLY_WOULD_CROSS_ERROR: the order would execute immediately. Choose a non-crossing price or change the post-only intent and re-sign.
• The *_OTHER_ERROR codes are operation-specific failures without a more specific code. Use message for display or troubleshooting; do not parse it as a stable machine-readable contract.

Pre-trade risk checks:

• ACCOUNT_BELOW_LIQUIDATION_MARGIN_ERROR: the account does not meet the required liquidation-margin or balance conditions.
• ACCOUNT_BELOW_INITIAL_MARGIN_ERROR: the proposed trade does not meet the account's initial-margin or collateral requirements. An account already below initial margin may trade only when the trade improves its health.
• INSUFFICIENT_BALANCE_ERROR: the account cannot fund the order.
• OPEN_INTEREST_CAP_ERROR, OPEN_INTEREST_BUDGET_ERROR: the trade exceeds the market's available open-interest capacity.
• REDUCE_ONLY_CONDITION_NOT_MET_ERROR: the order would not strictly reduce the current position, for example because there is no position, the side is wrong, or the size would reverse it.

A request refused by risk checks is rejected in full. A rejected create produces no order; a rejected modify leaves the existing order unchanged. These failures require a change in account or market state, a smaller order, more collateral, or a user decision; do not automatically retry them unchanged. Resting-order cancellations appear separately as cancelReason: RISK_CANCELLED. A protective stop whose child fails risk checks is cancelled with RISK_REJECTED; see CancelReason.

Protective stops:

• TRIGGER_IOC_MUST_NOT_EXPIRE_ERROR: an IOC trigger cannot carry expiresAfter. Only GTT orders carry an expiry; GTC and IOC must omit it. Invalid time-in-force/expiry combinations can also return INPUT_VALIDATION_ERROR. Correct the combination and re-sign.
• TRIGGER_LIMIT_OUTSIDE_BAND_ERROR: the stop's limitPx is outside the permitted range around triggerPx, or stops are unavailable for the market. Move the limit closer to the trigger and re-sign when the price is out of range. If the message indicates stops are unavailable, changing the price will not resolve it.
• TRIGGER_ALREADY_EXISTS_ERROR: the account already has an armed stop of the same type on that market. At most one stop-loss and one take-profit may be armed per account and market. Modify or cancel the existing stop before replacing it.

Rate limits and resting-order caps:

• RATE_LIMITED_ERROR: the account's request budget for this operation is exhausted. Create and modify share a placement budget; single cancels, bulk cancels, and cancel-all-after control have separate budgets. Budgets are shared across markets, signers, REST, and WebSocket requests for the same account. Wait at least retryAfterMs milliseconds before retrying. This is a minimum wait, not a reserved request slot; concurrent traffic can use the available budget. Disarming an armed cancel-all-after countdown is never throttled. A disarm when no countdown is armed can be throttled.
• OPEN_ORDER_COUNT_EXCEEDED_ERROR: a new resting order would exceed the account's total or per-market resting-order count. Cancel orders or allow them to fill before placing more. Modifications do not increase the count.
• OPEN_ORDER_NOTIONAL_EXCEEDED_ERROR: the account's combined resting-order notional would exceed its limit. Notional is remaining quantity multiplied by limit price for resting GTC/GTT orders. Creates are checked against the submitted quantity before any immediate fills; modifications are checked against the resulting notional. IOC orders and armed triggers are exempt; fired trigger children that rest count toward the limits. Cancel or shrink resting orders, or submit a smaller order.

Resting-order cap errors carry no retryAfterMs: waiting alone does not resolve them. CAPACITY_LIMITED_ERROR means the venue temporarily cannot accept a create or modify. It carries no retry hint; use backoff with jitter. Cancels and cancel-all-after operations are not refused for venue capacity, though their separate account rate limits still apply.

Temporary availability:

• CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR: an order that would execute immediately cannot currently pass the required pre-trade checks. Retry after a short delay. Existing resting orders remain in place; non-crossing orders and cancellations remain available.
• SERVICE_UNAVAILABLE_ERROR: the request was not accepted. Account-owner, signature or permission checks were unavailable before dispatch, or the transport did not send the request (including a full outbound queue). Re-sign with a fresh nonce and resubmit, retaining the same clientOrderId when supplied. Back off while the service remains unavailable. An unchanged nonce may already be below the signer's nonce floor because a later request was accepted.
• ORDER_OUTCOME_UNKNOWN_ERROR: the transport failed after the request may have reached the matching engine. The operation may have been applied. Reconcile open orders and executions before resubmitting; never replace an unresolved attempt with a fresh nonce. Retain the complete signed request, including operation, account, market/filter scope, nonce, and order identifiers. Responses do not provide an acceptance receipt or an outcome-query mechanism. Absence from open orders is not proof of failure: the order may have filled, and read data can lag. Executions correlate by order/fill IDs, not request nonces. Insufficient or ambiguous evidence remains unresolved. For cancelAllAfter, open orders do not establish whether a timer was armed, refreshed, or disarmed.

Permission errors such as NOT_WHITELISTED_ERROR and ACCOUNT_SUSPENDED_ERROR are not resolved by automatic retries. Contact support if an expected operation is refused.

Retry policy: retry unchanged after a short delay for CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR; re-sign with a fresh nonce for SERVICE_UNAVAILABLE_ERROR; reconcile first for ORDER_OUTCOME_UNKNOWN_ERROR; retry RATE_LIMITED_ERROR after at least retryAfterMs; retry CAPACITY_LIMITED_ERROR using backoff with jitter. Correct validation failures and re-sign where required. Reconcile order state before retrying an unanswered request, because a transport timeout or disconnect does not establish that the request was rejected.

application/json

500

Internal server error

application/json

post/cancelAll

POST /v2/cancelAll HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 146

{
  "accountId": 12345,
  "symbol": "BTCRUSDPERP",
  "signature": "0x1234...",
  "nonce": "1234567890",
  "deadline": 1676923200,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "cancelledCount": 5,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Set cancel-all-after countdown

post

Arm, refresh, or disarm an account-scoped cancel-all-after countdown. The same countdown can be managed interchangeably over REST and the order-entry WebSocket.

Countdown controls

• Send timeoutMs in [5000, 60000] milliseconds to arm a countdown. Another successful call replaces it with a new countdown of the requested duration, including when the duration is unchanged.

• Send timeoutMs: 0 to disarm; it is a no-op if no countdown is armed.

• Only another cancelAllAfter call refreshes the countdown. Order traffic and pings do not refresh it; a WebSocket close does not trigger it. It survives reconnects until it fires or is disarmed.

• For example, arm for 30000 ms and refresh every 10–15 seconds. Refresh well before expiry.

Affected orders

On expiry, all open orders for accountId are cancelled except protective stops (STOP_LOSS / TAKE_PROFIT) and their fired children. Cancellations appear on walletOrderChanges with CANCEL_ALL_AFTER. Explicit POST /v2/cancelAll also cancels protective stops and their children.

Signature and response

Sign accountId, timeoutMs, and nonce in the EIP-712 CancelAllAfterDetails, using the envelope and signer requirements in the request fields. deadline is the signature validity in Unix seconds; it does not set countdown expiry. The response's triggerAt is an advisory Unix timestamp in milliseconds and is omitted when disarming.

Rate limits

Countdown control has a separate account budget from placements and cancels. Disarming an armed countdown is never throttled; a no-op disarm can be throttled. Rate-limit rejections return RATE_LIMITED_ERROR with retryAfterMs. See the HTTP 400 response reference for recovery guidance.

Body

Arm, refresh, or disarm the account's cancel-all-after countdown using a signed request. See POST /v2/cancelAllAfter for affected orders, refresh rules, disconnect behavior, and throttling.

accountIdintegerRequired

Account ID whose open orders are covered by the countdown.

Example: 12345

timeoutMsintegerRequired

Countdown duration in milliseconds: 0 disarms; 5000–60000 arms or refreshes. Other values return INPUT_VALIDATION_ERROR. Signed into CancelAllAfterDetails. See POST /v2/cancelAllAfter for countdown and throttling behavior.

Example: 30000

signaturestringRequired

EIP-712 signature over the CancelAllAfter(uint64 verifyingChainId, uint64 deadline, CancelAllAfterDetails cancelAllAfter) envelope, where CancelAllAfterDetails(uint64 accountId, uint64 timeoutMs, uint64 nonce). See the EIP-712 signing reference in the Reya docs (https://docs.reya.xyz/developers/readme/signatures-and-nonces) for the exact typehash string and signing algorithm.

Example: 0x1234...

noncestringRequired

Monotonically increasing per-signer nonce. A fresh nonce is required on every arm/refresh/disarm call; replayed nonces are rejected with INVALID_NONCE_ERROR.

Example: 1234567890

signerWalletstringRequired

Address of the signer that produced the EIP-712 signature. Required on cancelAllAfter and must match the signature. Omit signerWallet from cancelOrder and cancelAll requests.

Example: 0x6c51275fd01d5dbd2da194e92f920f8598306df2Pattern: ^0x[a-fA-F0-9]{40}$

deadlineintegerRequired

Unix seconds. Signature-validity deadline signed into the CancelAllAfter envelope. It controls request acceptance, not countdown expiry; see timeoutMs and the response's triggerAt.

Example: 1676923200

Other propertiesanyOptional

Responses

200

Cancel-all-after response

application/json

accountIdintegerRequired

Account ID the countdown applies to, echoed from the request.

Example: 12345

timeoutMsintegerRequired

Effective countdown duration in milliseconds; 0 means the switch is now disarmed.

Example: 30000

triggerAtintegerOptional

Advisory Unix timestamp in milliseconds at which the countdown will fire unless refreshed or disarmed. The countdown starts when the request is accepted, using the requested timeoutMs. Use this timestamp for display and schedule refreshes well before expiry. Omitted when timeoutMs is 0.

Example: 1747927119946

Other propertiesanyOptional

400

Standardized error codes for API responses. Branch on error, not the free-text message or HTTP status. Every venue rejection on REST uses HTTP 400 with a RequestError body. The order-entry WebSocket returns the same code and optional retryAfterMs in its { ok: false, error } response. HTTP 429 is reserved for infrastructure-level (per-IP) limits in front of the API and is never a venue verdict.

Validation and authorization:

• INPUT_VALIDATION_ERROR: correct the request's fields or order-class combination before resubmitting. Immutable fields on a modify must match the existing order.
• SYMBOL_NOT_FOUND_ERROR, NO_ACCOUNTS_FOUND_ERROR: the requested market or account data is unavailable; check the request and current market/account state.
• NUMERIC_OVERFLOW_ERROR, PRICE_QTY_BOUNDS_ERROR: a numeric value is out of range, or price/quantity is invalid for the market. Check price increments and quantity limits.
• UNAUTHORIZED_SIGNATURE_ERROR: the signature is invalid or unauthorized. UNAUTHORIZED_ACCOUNT_ERROR: the signer is not permitted to act on the target order. For an armed protective stop, modify and cancel require the signer that created it.
• INVALID_NONCE_ERROR: use a fresh, monotonically increasing nonce for the signer and re-sign.
• ORDER_DEADLINE_PASSED_ERROR, ORDER_DEADLINE_TOO_HIGH_ERROR: the signature's deadline has passed or is too far in the future. Correct it and re-sign. This deadline controls request acceptance, not the lifetime of an accepted order.
• ORDER_EXPIRES_TOO_SOON_ERROR: a GTT order's expiresAfter leaves insufficient time for execution and settlement. Choose a later expiry and re-sign. GTT orders can be cancelled before their signed expiry to allow settlement; for a protective stop this applies to both its armed phase and its fired child.
• SERVICE_DISABLED_ERROR, TRADING_HALTED_ERROR: order entry is unavailable for the market. Check market availability before submitting again.
• DUPLICATE_CLIENT_ORDER_ID_ERROR: the client ID belongs to a live order. Reconcile that order before submitting another.
• ORDER_NOT_FOUND_ERROR: the target order was not found. Refresh its state before retrying.
• EMPTY_MODIFY_ERROR: a LIMIT modification makes no change. An armed trigger may be re-signed at unchanged prices.
• MODIFY_QTY_BELOW_FILLED_ERROR: the modified total quantity must exceed the quantity already filled.
• POST_ONLY_WOULD_CROSS_ERROR: the order would execute immediately. Choose a non-crossing price or change the post-only intent and re-sign.
• The *_OTHER_ERROR codes are operation-specific failures without a more specific code. Use message for display or troubleshooting; do not parse it as a stable machine-readable contract.

Pre-trade risk checks:

• ACCOUNT_BELOW_LIQUIDATION_MARGIN_ERROR: the account does not meet the required liquidation-margin or balance conditions.
• ACCOUNT_BELOW_INITIAL_MARGIN_ERROR: the proposed trade does not meet the account's initial-margin or collateral requirements. An account already below initial margin may trade only when the trade improves its health.
• INSUFFICIENT_BALANCE_ERROR: the account cannot fund the order.
• OPEN_INTEREST_CAP_ERROR, OPEN_INTEREST_BUDGET_ERROR: the trade exceeds the market's available open-interest capacity.
• REDUCE_ONLY_CONDITION_NOT_MET_ERROR: the order would not strictly reduce the current position, for example because there is no position, the side is wrong, or the size would reverse it.

A request refused by risk checks is rejected in full. A rejected create produces no order; a rejected modify leaves the existing order unchanged. These failures require a change in account or market state, a smaller order, more collateral, or a user decision; do not automatically retry them unchanged. Resting-order cancellations appear separately as cancelReason: RISK_CANCELLED. A protective stop whose child fails risk checks is cancelled with RISK_REJECTED; see CancelReason.

Protective stops:

• TRIGGER_IOC_MUST_NOT_EXPIRE_ERROR: an IOC trigger cannot carry expiresAfter. Only GTT orders carry an expiry; GTC and IOC must omit it. Invalid time-in-force/expiry combinations can also return INPUT_VALIDATION_ERROR. Correct the combination and re-sign.
• TRIGGER_LIMIT_OUTSIDE_BAND_ERROR: the stop's limitPx is outside the permitted range around triggerPx, or stops are unavailable for the market. Move the limit closer to the trigger and re-sign when the price is out of range. If the message indicates stops are unavailable, changing the price will not resolve it.
• TRIGGER_ALREADY_EXISTS_ERROR: the account already has an armed stop of the same type on that market. At most one stop-loss and one take-profit may be armed per account and market. Modify or cancel the existing stop before replacing it.

Rate limits and resting-order caps:

• RATE_LIMITED_ERROR: the account's request budget for this operation is exhausted. Create and modify share a placement budget; single cancels, bulk cancels, and cancel-all-after control have separate budgets. Budgets are shared across markets, signers, REST, and WebSocket requests for the same account. Wait at least retryAfterMs milliseconds before retrying. This is a minimum wait, not a reserved request slot; concurrent traffic can use the available budget. Disarming an armed cancel-all-after countdown is never throttled. A disarm when no countdown is armed can be throttled.
• OPEN_ORDER_COUNT_EXCEEDED_ERROR: a new resting order would exceed the account's total or per-market resting-order count. Cancel orders or allow them to fill before placing more. Modifications do not increase the count.
• OPEN_ORDER_NOTIONAL_EXCEEDED_ERROR: the account's combined resting-order notional would exceed its limit. Notional is remaining quantity multiplied by limit price for resting GTC/GTT orders. Creates are checked against the submitted quantity before any immediate fills; modifications are checked against the resulting notional. IOC orders and armed triggers are exempt; fired trigger children that rest count toward the limits. Cancel or shrink resting orders, or submit a smaller order.

Resting-order cap errors carry no retryAfterMs: waiting alone does not resolve them. CAPACITY_LIMITED_ERROR means the venue temporarily cannot accept a create or modify. It carries no retry hint; use backoff with jitter. Cancels and cancel-all-after operations are not refused for venue capacity, though their separate account rate limits still apply.

Temporary availability:

• CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR: an order that would execute immediately cannot currently pass the required pre-trade checks. Retry after a short delay. Existing resting orders remain in place; non-crossing orders and cancellations remain available.
• SERVICE_UNAVAILABLE_ERROR: the request was not accepted. Account-owner, signature or permission checks were unavailable before dispatch, or the transport did not send the request (including a full outbound queue). Re-sign with a fresh nonce and resubmit, retaining the same clientOrderId when supplied. Back off while the service remains unavailable. An unchanged nonce may already be below the signer's nonce floor because a later request was accepted.
• ORDER_OUTCOME_UNKNOWN_ERROR: the transport failed after the request may have reached the matching engine. The operation may have been applied. Reconcile open orders and executions before resubmitting; never replace an unresolved attempt with a fresh nonce. Retain the complete signed request, including operation, account, market/filter scope, nonce, and order identifiers. Responses do not provide an acceptance receipt or an outcome-query mechanism. Absence from open orders is not proof of failure: the order may have filled, and read data can lag. Executions correlate by order/fill IDs, not request nonces. Insufficient or ambiguous evidence remains unresolved. For cancelAllAfter, open orders do not establish whether a timer was armed, refreshed, or disarmed.

Permission errors such as NOT_WHITELISTED_ERROR and ACCOUNT_SUSPENDED_ERROR are not resolved by automatic retries. Contact support if an expected operation is refused.

Retry policy: retry unchanged after a short delay for CROSSING_ORDERS_TEMPORARILY_UNAVAILABLE_ERROR; re-sign with a fresh nonce for SERVICE_UNAVAILABLE_ERROR; reconcile first for ORDER_OUTCOME_UNKNOWN_ERROR; retry RATE_LIMITED_ERROR after at least retryAfterMs; retry CAPACITY_LIMITED_ERROR using backoff with jitter. Correct validation failures and re-sign where required. Reconcile order state before retrying an unanswered request, because a transport timeout or disconnect does not establish that the request was rejected.

application/json

500

Internal server error

application/json

post/cancelAllAfter

POST /v2/cancelAllAfter HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 201

{
  "accountId": 12345,
  "timeoutMs": 30000,
  "signature": "0x1234...",
  "nonce": "1234567890",
  "signerWallet": "0x6c51275fd01d5dbd2da194e92f920f8598306df2",
  "deadline": 1676923200,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "accountId": 12345,
  "timeoutMs": 30000,
  "triggerAt": 1747927119946,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}