Cancel

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'cancel', target: ctx.originalOrderId,
      attempt: ctx.cancelAttemptId, goodUntil: ctx.goodUntil } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'cancel', target: ctx.originalOrderId,
      attempt: ctx.cancelAttemptId, goodUntil: ctx.goodUntil } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Carrier: POST /v1/exchange (encrypted binary). Permission: Owner, or CANCEL agent for its own order. Cancel without pretending away late fills. The same command is available over WebSocket.

Fields below describe the SDK request before encryption and the decoded reply. The HTTP body is encrypted binary application/octet-stream, not JSON. Use a verified SDK client; the interactive playground is disabled.

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'cancel', target: ctx.originalOrderId,
      attempt: ctx.cancelAttemptId, goodUntil: ctx.goodUntil } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Request fields

The client supplies the configured domain, account, policy, signer and verified session binding, and signs the canonical envelope.

Uint8Array (32 bytes)

required

Nonzero private request ID. Retain it for an exact retry; use a distinct ID for a different intent.

bigint (u64)

required

Current account authority epoch.

bigint (u64)

required

Authentication expiry in milliseconds, within the verified session and deployment limits.

"cancel"

required

Command discriminator.

Uint8Array (32 bytes)

required

Original admitted private order.

Uint8Array (32 bytes)

required

Stable distinct cancel attempt; preserve on retry.

bigint (u64)

required

Financial cancellation deadline in milliseconds.

Response fields

The example uses illustrative quote atoms and configured IDs, not live venue data. A receipt records operation progress; acceptance is not execution or payment.

"receipt"

required

Response discriminator.

Uint8Array (32 bytes)

required

Durable operation ID. For an operation lookup, this is the target ID, not the query ID.

Uint8Array (32 bytes)

required

Commitment to the immutable economic intent.

number (u32)

required

Governed policy version.

Outcome

required

rejected, accepted, dispatched, acknowledged, partial, complete or unknown. See lifecycle.

bigint (i64)

required

Actual attributed signed lots, not requested quantity.

bigint (i128)

required

Qualified net payment to the beneficiary, in quote atoms.

bigint (i128)

required

Actual customer-paid payout rail fees; not ordinary trading fees.

bigint (i128)

required

Declared fee cap: absolute requested lots × fee-per-lot for orders, or extra rail-fee cap for payouts. Not the amount charged.

boolean

required

Whether the operation may have escaped for external execution. False alone is not a final settlement guarantee.

boolean

required

The recorded payout partial-dispatch consent. False for unrelated commands.

Behavior

Receipt for the cancel request. Unexposed orders can release local reservations; exposed ones require cancellation/reconciliation. Cancel ACK is not terminal proof. Query original order and cancel operation as needed. No raw native cancel-all.

Errors and reconciliation

Typed errors are returned inside the encrypted reply, not as field-specific HTTP status codes. Invalid fields, expired or out-of-scope authority, conflicting intent IDs and unavailable required evidence fail closed. A delivery error or timeout is not a rejection. Reconnect with fresh attestation and reconcile the original operation ID before any economic retry. See lifecycle, limits and availability.

Overview

Commands

Private reads

WebSocket

Request fields

Response fields

Behavior

Errors and reconciliation

​Request fields

​Response fields

​Behavior

​Errors and reconciliation

Request fields

Response fields

Behavior

Errors and reconciliation