Refusals

A request can be refused in two places:

The gateway checks what the settlement contract will check: signature, signing key, nonce range and floor, the instrument, the ladder, the fee cap and the expiry. A refusal is HTTP 422 with {"error": "<reason>"}, and nothing reaches the engine.
The engine decides everything else: cash, nonce reuse, the instrument's state. Its refusal is a code, for example INSUFFICIENT_CASH, in the order's code (with ?wait), in a refused event on the WebSocket, or as a cancel's status.

A nonce the engine accepts is spent even if the order is then refused for another reason, so a refused order cannot be resent under the same nonce. Sign it again under a new one.

Gateway reasons

Reason	What to do
`signature: …`, `signature does not recover`	The signature is malformed, or not over these exact terms and this domain.
`signed by a key not registered for the maker, or expired`	Sign with the account's own key, or register this key with `setSigningKey`.
`signed by another key: only the account's own may`	A withdrawal request must be signed by the account itself.
`the order outlives its signing key: …`	Shorten `expiresAt`, or extend the key.
`nonce must be in [1, 2^62)`	See Nonces.
`nonce names shard N; this engine is shard 0`	Bits 54–61 of the nonce must be zero.
`nonce below the maker's on-chain floor`	You raised your floor with `cancelUpTo`; use a nonce above it.
`bad order terms`	`side` is not 0 or 1, or `size` is 0.
`specifier names no listable contract`	The specifier does not decode to a listed strike, European style and multiplier 100.
`no such instrument`	Well-formed, but not listed. Check `GET /v1/instruments`.
`price is off the ladder`	See the tick ladder.
`order outlives its contract`	`expiresAt` is after the contract's expiry.
`order already expired`	`expiresAt` is in the past.
`fee cap below the instrument's fees`	Raise `maxFeeBps` to at least both of the instrument's rates.
`maxFeeBps is a uint8: at most 255`
`size exceeds the engine's maximum order`	At most 2³⁰ contracts.
`no engine account for the maker: deposit first`	Your first deposit opens your account.
`account inactive`	The account is deactivated or frozen.
`a batch holds 1..256 members`
`member N: a batch is one maker's`	Every item in a batch must have the same maker.
`member N: <reason>`	Member `N` (from 0) failed with `<reason>`; nothing in the batch was sent.

Engine codes

The codes a participant can meet:

Code	Meaning
`INSUFFICIENT_CASH`	Free cash does not cover what the order adds to the account's requirement (see Security), or a withdrawal exceeds free cash.
`INVALID_PRICE`	The price is off the ladder.
`PRICE_ABOVE_MAX_PAYOFF`	Above `1000000 − K` for a call or `K` for a put.
`INVALID_QUANTITY`	The quantity is out of range.
`INSTRUMENT_NOT_ACTIVE`	The contract is halted or settling. Cancels are still accepted.
`ORDER_EXPIRED`	The order's expiry had passed by the time the engine applied it.
`NONCE_USED`	This nonce has already been used by this account, for an order, a cancel or a withdrawal. With `?wait`, `order` says where the order that used it stands.
`NONCE_BELOW_WINDOW`	The nonce is more than 4096 below the highest this account has used. Keep nonces increasing.
`NONCE_OUT_OF_SPACE`	The nonce is zero or outside the account range.
`NONCE_BELOW_FLOOR`	Below the floor set on chain with `cancelUpTo`.
`ORDER_NONCE_NOT_FOUND`	A cancel named an order that is not resting: it filled, expired, was cancelled, or never rested.
`ORDER_OUTLIVES_KEY`	The order would rest past its signing key's expiry.
`SIGNING_KEY_INVALID`	The signing key is not registered for the account, or has lapsed.
`ACCOUNT_NOT_ACTIVE`	The account is deactivated.
`ORDER_POOL_FULL`, `POSITION_POOL_FULL`	The engine is at capacity. Try again later.

Every other code names a fault in the request's encoding or an administrative condition, and is listed in the engine's source.