Cancel Order

Use DELETE /orders/{orderId} or DELETE /orders?client_order_id=.... Auth is bearer plus the same one-shot HPKE body documented in Place Order; plaintext or an empty DELETE body is not valid.

The encrypted logical CancelOrderInput contains order_id, symbol_id, and correlation_id. The authenticated user comes from the bearer session. Cancelling by client_order_id first resolves the account-owned mapping; an unknown mapping returns the normal API error envelope.

{
  "header": {
    "symbol_id": 1,
    "request_type": "cancel",
    "nonce": 1,
    "body_length": 128,
    "correlation_id": "99"
  },
  "encrypted_body": "<base64 ciphertext>",
  "encapped_key": "<base64 32-byte HPKE key>",
  "request_id": 43
}

Success returns code: 0 with an encrypted ACK (encrypted, message_type, encrypted_body, nonce, fencing_epoch, correlation_id, request_id) inside data. It does not return plaintext final order state. Decrypt the ACK and follow Order Updates.