POST /api/v1/orders

Submit an order

Submit an order.

operationId: createOrderV1 · CCXT method: createOrder · Rate-limit class: trading

Declared server differs from the callable one. This path declares its own servers base of https://exchange.nexus.xyz, without the /api/exchange mount the document default carries. Measured 2026-09-02, the override is not routed — https://exchange.nexus.xyz/api/v1/orders returns 404 while the gateway form in the sample below is routed. A client generated from this contract will aim at the override; pin the gateway base until the per-network hosts are live. See Networks.

Authentication: hmacAuth.

Request body

Required. OrderRequest — application/json.

Responses

Status	Body	Meaning
200	OrderResponse	Idempotent replay: this client_id was already accepted, and the body is the order that first request created. Nothing was placed by this request, so branch on the status rather than assuming 201. fills is empty here even if the original order has since traded; read its current state from GET /orders/{order_id} (unversioned — the versioned path carries only DELETE and PATCH). Reachable only while the original order is still resting. The replay answers from the live book, so a fully-filled, cancelled or expired original, and any market/IOC/FOK order that never rested, is answered 409 instead. The duplicate is prevented either way; what differs is whether the original can be handed back inline.
201	OrderResponse	Order accepted
400	— (no schema declared)	Validation error (insufficient margin, invalid tick size, etc.)
401	— (no schema declared)	—
403	— (no schema declared)	—
409	— (no schema declared)	This client_id is already claimed, and the order it created is not currently resting, so it cannot be returned inline (code: DuplicateClientId). This is the expected answer whenever the original is no longer on the book, not a rare edge: a filled, cancelled or expired order, and anything that never rested, all land here. The message names the order's id; find it in GET /api/v1/orders/history, which retains terminal orders. Do not retry with the same key, since the outcome will not change, and do not re-submit under a new key without first establishing what the original order did.
429	— (no schema declared)	—

Example

cURL

curl -X POST 'https://exchange.nexus.xyz/api/exchange/api/v1/orders' \
  -H 'X-API-Key: nx_7f3a1b...' \
  -H 'X-Timestamp: 1776033911836' \
  -H 'X-Signature: <hmac-sha256>' \
  -H 'Content-Type: application/json'

Python

import requests

headers = {
    "X-API-Key": "nx_7f3a1b...",
    "X-Timestamp": "1776033911836",
    "X-Signature": "<hmac-sha256>",
    "Content-Type": "application/json"
}

response = requests.post("https://exchange.nexus.xyz/api/exchange/api/v1/orders", headers=headers)
response.raise_for_status()
print(response.json())

TypeScript

const response = await fetch("https://exchange.nexus.xyz/api/exchange/api/v1/orders", {
  method: "POST",
  headers: {
    "X-API-Key": "nx_7f3a1b...",
    "X-Timestamp": "1776033911836",
    "X-Signature": "<hmac-sha256>",
    "Content-Type": "application/json"
  },
});
if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
console.log(await response.json());

X-Signature is a placeholder: it is derived from this specific request. See Authentication for the canonical string and the HMAC rule.

---

_{Generated from eng/apps/exchange/api/openapi.json (spec 0.9.36). Do not edit by hand — regenerate with python3 product/docs/tools/api-reference/generate.py. Hand-authored context lives in the Guides pages.}