Place & Cancel Orders (Signed)
Place limit/market orders, cancel, and modify via the unified transaction endpoint
ALO_SLIDE / ALO_JOIN modes, resting-price
alignment, and conditional slippage options below apply after the scheduled upgrade.
Only resting ALO/post-only orders are scheduled to be cleared. GTC and
already-placed conditional orders remain. Untriggered on-fill actions attached
to a cleared ALO order are removed with that parent order.POST /order endpoint. Send a transaction with an actions array; each action is a tagged object (e.g. {"l": {...}} for a limit order).
BigInt(Date.now()) * 1_000_000n.Transaction Envelope
Every request toPOST /order has this shape:
Optional Request Header
POST /order accepts an optional x-bulk-sig-mode: raw | offchain | base58 header that hints which signature verifier path to try first. The header is a hint only; signature validity still decides accept/reject. Omit it for the default raw canonical-binary path. See Offchain Signing Mode.
Isolated Account Routing (i)
Order actions that produce a position (l, m, st, tp, rng, trl) carry a required i boolean. When i = true, the order is routed into a per-instrument isolated account under the signing account instead of its base account. A trig basket has no top-level i; each nested action controls its own routing. Isolated accounts are managed entirely through this flag; they are never set as account on a transaction.
- The isolated account is auto-derived from the signing
accountand the instrument; no separate “create” call is required. The protocol attaches it under the signing master/sub-account on first use. - Resulting fills, positions, fees, and risk live on the isolated account, not the base account. Isolated-account rows in account snapshots and history carry
iso = trueand expose the isolated account’s pubkey asisoPubkey. - A liquidation on the isolated account only touches that account’s margin. The signing master/sub-account is unaffected.
- Top up isolated-account margin by sending a
transferaction withto = isoPubkey. This is the only place an isolated-account pubkey is used directly. See Transfer. - Set
i = falseto keep base-account routing.
Builder Codes
Builder codes are optional routed-order fees and only belong on the routedm or l order. Use abc once to approve a recipient, then include the builderCode payload on the order sent through that builder.
feeis basis points and must be1..=15.- Each master account can approve at most 10 recipients. A recipient must be an existing canonical root payout account and cannot be the signer, its root, or another account in the same account tree.
- Orders without a builder code omit the field entirely.
"builderCode": nullis rejected by the JSON API. - In canonical signing bytes, an absent
builderCodecontributes no bytes; a present value contributes theSometag (1), recipient pubkey, and fee. - The builder-code fee applies only to the side whose order carried
builderCode, whether that side later fills as maker or taker. abcandrbcmust be signed by the master account. Agent wallets cannot approve or revoke builder-code recipients. Account snapshots expose approved builder-code recipients asbuilderCodeApprovals: [{ "recipient": "...", "maxFee": 5 }].- Revoking with
rbcprevents later builder-code fee settlement for resting orders that have not filled yet.
Place Limit Order (l)
GTC (Good Till Cancel)
Standard limit order that rests on the book.IOC (Immediate or Cancel)
Fills immediately or cancels the unfilled portion.ALO (Add Liquidity Only / Post-Only)
Maker only; rejected if it would cross the spread.ALO Slide and ALO Join
ALO_SLIDE moves a crossing order to the most aggressive non-crossing display
tick. ALO_JOIN moves a crossing order to the same-side best quote; if there is
no same-side quote, it falls back to Slide. A non-crossing order keeps its
tick-aligned submitted price. Both modes remain post-only and are still subject
to the usual risk and order-validity checks.
actions array for
HTTP or WebSocket submissions. JSON uses the uppercase names; 3 and 4 are
their binary signing enum indices, not JSON request values. Existing indices
remain GTC = 0, IOC = 1, and ALO = 2.
Account/order updates use postOnlySlide and postOnlyJoin respectively.
GET /exchangeInfo advertises uppercase names in timeInForces.
Resting Price Alignment
Orders capable of resting (GTC and the ALO family) align to the market’s
pricePrecision / tickSize: buy prices round down and sell prices round up.
IOC prices retain native fixed-point precision. For Slide/Join, read the
order’s reported working price rather than assuming it equals the submitted price.
Read sizeDecimals and sizeIncrement from
GET /exchangeInfo for quantity precision.
The increment is not a minimum trade notional; minNotional still applies.
With Builder Code
Limit Order Fields
Place Market Order (m)
Executes at best available price immediately.
An optional slippage override is expressed in basis points. When omitted,
the market’s configured default applies. This bounds permitted execution; it
does not guarantee a fill.
Conditional Slippage Overrides
Market-executing stop (st), take-profit (tp), and trailing (trl) actions
accept an optional slippage value in basis points. Range (rng) actions use
independent slSlippage and tpSlippage values for their stop-loss and
take-profit legs. When absent, the applicable security default is used. A
limit-executing leg continues to use its explicit limit price.
Use the updated SDK’s signing implementation for conditional actions and
batches that contain them: the conditional slippage fields participate in
canonical signing even when an override is omitted. Do not merely append a
JSON field to a transaction signed with an older conditional-action encoder.
Modify Order (mod)
Change the size of an existing resting order.
Cancel Single Order (cx)
Cancel a specific order by ID.
Cancel All Orders (cxa)
Cancel all in one symbol
Cancel all across all symbols
Batch Actions
Send multiple actions in one transaction (e.g. cancel + place).Stop Order (st)
Place a conditional stop order that triggers when price crosses a threshold.
Take Profit Order (tp)
Place a conditional take-profit order.
st).
Range / OCO Order (rng)
Place a range collar (one-cancels-the-other stop + take-profit pair).
Trigger Basket (trig)
Place a trigger that executes a list of actions when threshold is crossed.
i; each nested order or conditional action
controls its own isolated routing.
Nested actions support: m, l, mod, cx, cxa, st, tp, rng, trl.
Trailing Stop (trl)
Place a trailing conditional that adjusts with favorable price movement.
On-Fill (of)
Register one-shot follow-up actions that execute on the first fill of an
embedded trigger action.
trigger must contain exactly one m or l action. Builder codes work on an
embedded trigger or consequent m / l exactly as they do on a top-level order.
Nested actions support: m, l, mod, cx, cxa, st, tp, rng, trig, trl.
cx with the conditional order ID or cxa to cancel all orders including conditionals.Response Format
All submissions return anOrderResponse with one status per execution event:
status: "error" and statuses: [{"error":{"message":"bad signature"}}] or statuses: [{"error":{"message":"unauthorized signer"}}].
Non-Terminal (order still active)
Terminal (order complete)
Response Examples
Headers
Optional signature-mode hint. Hint only - signature validity still decides accept/reject.
Omit to use the default raw canonical-binary verification path. Set to offchain when the
transaction was signed using the v0 Solana offchain envelope.
raw, offchain, base58 Body
Unified signed transaction. All state-mutating operations use this model.
The actions array can contain any combination of action types, executed atomically.
Must be signed - see Transaction Signing for signing details.
Array of actions to execute atomically. Each action is a tagged object where the key is the compact action tag.
Action types: l, m, mod, cx, cxa, st, tp, rng, trig, trl, of, faucet, agentWalletCreation, abc, rbc, updateUserSettings, createSubAccount, removeSubAccount, renameSubAccount, transfer, whitelistFaucet (admin), px (admin), o (admin)
Tagged action object. Each action type is an externally tagged enum using compact action tags.
Unique nonce for replay protection (use timestamp in nanoseconds or incrementing counter)
Account public key (base58) whose account is being acted on. Must be a master pubkey or a sub-account pubkey. Per-instrument isolated accounts are managed implicitly via the i flag on order actions and are never set as account.
"FuueqefENiGEW6uMqZQgmwjzgpnb85EgUcZa5Em4PQh7"
Signer public key (base58); who is signing. One of:
- the
accountitself; - when
accountis a sub-account: the parent master, or an agent wallet registered on the parent master (automatically authorized for its sub-accounts); - an agent wallet registered directly on
account.
"FuueqefENiGEW6uMqZQgmwjzgpnb85EgUcZa5Em4PQh7"
Ed25519 signature of wincode_serialize(commission_signable_actions) + nonce_le_u64 + account + signature_domain_u8, where mainnet=1, testnet=2, and devnet=3 (base58)
"5j7sVt3k2YxPqH4w..."
Response
Transaction response.
Note: authentication failures are returned as HTTP 200 with
status: "error" and statuses: [{"error":{"message":"bad signature"}}]
or statuses: [{"error":{"message":"unauthorized signer"}}].
Transaction accepted. One status per execution event in response.data.statuses.
Response from POST /order. One entry in response.data.statuses per execution
event (e.g. one per order placed, or one for faucet/agent/settings).
Status variants: resting, working, filled, partiallyFilled, cancelled, cancelledRiskLimit,
cancelledSelfCrossing, cancelledReduceOnly, cancelledIoc,
rejectedCrossing, rejectedDuplicate, rejectedRiskLimit, rejectedInvalid, deposit, depositFailed, agentWallet, agentWalletFailed,
cancelOneRejected, cancelAllRejected, triggered, siblingCancelled, triggerFailed,
transfer, transferFailed, createSubAccount, createSubAccountFailed,
removeSubAccount, removeSubAccountFailed,
renameSubAccount, renameSubAccountFailed,
error.