List Orders

POST https://trade-uk.sandbox.zodiamarkets.com/api/3/zm/rest/orders

Outstanding Orders

Return the orders Zodia Markets is currently holding for you, optionally narrowed to one session.

Where Read Order State answers “what happened to this order”, this answers “what is outstanding” — the endpoint to reach for when a process restarts and needs to rebuild its picture, or when reconciling a session’s activity.

Both delivery models are covered: an order sent without autoSubscribe appears here alongside a subscribed one.

---

Request

Same authentication as Read Order State: a signed body carrying tonce or nonce, Rest-Key and Rest-Sign headers, and a signature over the path only — api/3/zm/rest/orders, without the query string. See Generate Signature →.

sessionId is optional. Supply it to narrow the result to one session; omit it for everything.

---

What You Get Back

A JSON array, empty when there is nothing to return.

No pagination, no ordering, no cap

This endpoint returns every order it is holding for you, in no defined order. There is no limit, no offset and no sort parameter, and the response is not truncated.

Narrow with sessionId where you can, and never depend on the order of the array. If you run high order volumes, prefer Read Order State for a targeted lookup.

Retention

An order stays in this list for 24 hours. Sending orderUnsubscribe acknowledges a subscribed order’s outcome and stops it being redelivered over the WebSocket, but it does not remove the order from this list — the record expires on its own.

For anything that executed and settled, Get Trades → is the durable record.

---

Code Example

Python

import hashlib
import hmac
import json
import time

import requests

api_key = "<your_api_key>"
api_secret = "<your_api_secret>"
base_url = "https://trade-uk.sandbox.zodiamarkets.com"

path = "api/3/zm/rest/orders"

# Every signed request must carry a nonce or tonce
body = {"tonce": int(time.time() * 1000000)}
body_json = json.dumps(body)

# The signature covers the path and the body - never the query string
message = f"{path}\0{body_json}"
signature = hmac.new(api_secret.encode(), message.encode(), hashlib.sha512).hexdigest()

response = requests.post(
    f"{base_url}/{path}",
    params={"sessionId": "trading-desk-1"},   # omit for every order
    headers={
        "Rest-Key": api_key,
        "Rest-Sign": signature,
        "Content-Type": "application/json",
    },
    data=body_json,
)

orders = response.json()

unresolved = [o for o in orders if o["orderStatus"] == "PENDING"]
print(f"{len(orders)} orders held, {len(unresolved)} without an outcome yet")

---

Related Documentation

• Read Order State - one order, by clientRequestId
• Order Sessions and Recovery - what a session is, and the three recovery paths
• Get Trades - the settled record of executed trades

Domain: Trading

Request

POST https://trade-uk.sandbox.zodiamarkets.com/api/3/zm/rest/orders

Headers

Header	Required	Description
Rest-Key	yes	API key for authentication
Rest-Sign	yes	Calculated API Signature

Parameters

Parameter	In	Type	Required	Description
sessionId	query	string		Return only orders bound to this session. Omit it to return every order Zodia Markets is still holding for you.

Body

Field	Type	Required	Description
tonce	integer (int64)	yes	The current Unix time in microseconds.
nonce	integer (int64)		Alternative to tonce. Every request must carry either nonce or tonce, and the value must parse as a whole number; a request with neither is rejected with 401.

Responses

200 — The matching orders, as a JSON array. An empty array when there are none.

Field	Type	Required	Description
[].messageType	string	yes	Always orderState
[].timestamp	integer (int64)	yes	When this response was produced, in milliseconds. Not the time of any order event — it is set as the record is serialised for your read.
[].transactionId	string	yes	Zodia Markets transaction reference for the order
[].clientRequestId	string	yes	Your identifier from the order request. Empty until the order has an outcome recorded, including on a lookup by clientRequestId.
[].orderStatus	string (enum)	yes	Outcome of the order. PENDING means no outcome has been recorded yet, and is returned for orders on either delivery model. INDETERMINATE means the outcome is genuinely unknown and the order may have executed — do not re-place it. — One of: SUCCESS, FAILED, INDETERMINATE, PENDING
[].subscriptionStatus	string (enum)	yes	NOT_SUBSCRIBED for an order sent without autoSubscribe. SUBSCRIBED until you send orderUnsubscribe, then UNSUBSCRIBED. — One of: NOT_SUBSCRIBED, SUBSCRIBED, UNSUBSCRIBED
[].sessionId	string		The session the order is bound to. null for an order sent without autoSubscribe — the field is present on the wire, carrying null.
[].message	string	yes	Outcome message, empty when there is none
[].code	string	yes	Outcome code, empty when there is none. See the Response / Error Code Reference.

400 — clientRequestId or sessionId breaches the identifier rules. A request missing a required header or query parameter is also rejected with 400, but by the framework and with a different body.

Field	Type	Required	Description
resultCode	string
timestamp	string		Unix time in milliseconds, as a string

401 — Authentication failed. A bad signature, a missing or stale tonce/nonce, and a replayed one are not distinguished.

Field	Type	Required	Description
resultCode	string
timestamp	string		Unix time in milliseconds, as a string