Operation

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'operation', target: ctx.originalOrderId } });

({
  kind: 'receipt',
  id: ctx.originalOrderId,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'operation', target: ctx.originalOrderId } });

({
  kind: 'receipt',
  id: ctx.originalOrderId,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Carrier: POST /v1/exchange (encrypted binary). Permission: Owner or live READ agent. Reconcile an original durable operation. The same command is available over WebSocket.

Fields below describe the SDK request before encryption and the decoded reply. The HTTP body is encrypted binary application/octet-stream, not JSON. Use a verified SDK client; the interactive playground is disabled.

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'operation', target: ctx.originalOrderId } });

({
  kind: 'receipt',
  id: ctx.originalOrderId,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 0n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Request fields

The client supplies the configured domain, account, policy, signer and verified session binding, and signs the canonical envelope.

Uint8Array (32 bytes)

required

Nonzero private request ID. Retain it for an exact retry; use a distinct ID for a different intent.

bigint (u64)

required

Current account authority epoch.

bigint (u64)

required

Authentication expiry in milliseconds, within the verified session and deployment limits.

"operation"

required

Command discriminator.

Uint8Array (32 bytes)

required

Original operation ID in this account, not native order ID or query ID.

Response fields

The example uses illustrative quote atoms and configured IDs, not live venue data. A receipt records operation progress; acceptance is not execution or payment.

"receipt"

required

Response discriminator.

Uint8Array (32 bytes)

required

Durable operation ID. For an operation lookup, this is the target ID, not the query ID.

Uint8Array (32 bytes)

required

Commitment to the immutable economic intent.

number (u32)

required

Governed policy version.

Outcome

required

rejected, accepted, dispatched, acknowledged, partial, complete or unknown. See lifecycle.

bigint (i64)

required

Actual attributed signed lots, not requested quantity.

bigint (i128)

required

Qualified net payment to the beneficiary, in quote atoms.

bigint (i128)

required

Actual customer-paid payout rail fees; not ordinary trading fees.

bigint (i128)

required

Declared fee cap: absolute requested lots × fee-per-lot for orders, or extra rail-fee cap for payouts. Not the amount charged.

boolean

required

Whether the operation may have escaped for external execution. False alone is not a final settlement guarantee.

boolean

required

The recorded payout partial-dispatch consent. False for unrelated commands.

Behavior

Current receipt for target, or not-found. Authentication precedes lookup. A missing operation alone is not proof that no external action occurred. Reconnect and reconcile the original ID; never replace uncertainty with a new trade.

Errors and reconciliation

Typed errors are returned inside the encrypted reply, not as field-specific HTTP status codes. Invalid fields, expired or out-of-scope authority, conflicting intent IDs and unavailable required evidence fail closed. An authorized missing target returns not-found. A delivery error or timeout is not a rejection. Reconnect with fresh attestation and reconcile the original operation ID before any economic retry. See lifecycle, limits and availability.

Overview

Commands

Private reads

WebSocket

Request fields

Response fields

Behavior

Errors and reconciliation

​Request fields

​Response fields

​Behavior

​Errors and reconciliation

Request fields

Response fields

Behavior

Errors and reconciliation