DELETE
/cancel-allCancel all orders
Cancels all open orders for the authenticated user. Works even in cancel-only mode.
- Base URL
- https://clob.polymarket.com
- Auth
- L2 API credentials (key, secret, passphrase)POLY_API_KEY, POLY_ADDRESS, POLY_SIGNATURE, POLY_PASSPHRASE, POLY_TIMESTAMP
- Rate limit
- 250 req / 10s (25 per second)sustained 6,000 req / 10 min
- Limit applies to
- DELETE /cancel-all
Things to know
Trading endpoints carry two Cloudflare limits: a burst of 250 req / 10s and a sustained 6,000 req / 10 min. Separate per-signer token buckets, sized by 30-day volume, apply on top.
Example
curl -X DELETE "https://clob.polymarket.com/cancel-all" \
-H "POLY_API_KEY: $POLY_API_KEY" \
-H "POLY_ADDRESS: $POLY_ADDRESS" \
-H "POLY_SIGNATURE: $POLY_SIGNATURE" \
-H "POLY_PASSPHRASE: $POLY_PASSPHRASE" \
-H "POLY_TIMESTAMP: $POLY_TIMESTAMP"L2 requests are signed with HMAC-SHA256 using your API secret, and the timestamp is part of the signature, so keep the machine's clock accurate. A missing credential or a stale signature both come back as Unauthorized/Invalid api key. The Python SDK signs for you.
Response fields
| Field | Type | Description |
|---|---|---|
| canceled | string[] | Array of order IDs that were successfully canceled |
| not_canceled | object | Map of order IDs that could not be canceled with error messages |
Responses
| Status | Meaning |
|---|---|
| 200 | Cancellation results for all orders |
| 401 | Unauthorized - Invalid API key or authentication failed |
| 500 | Internal server error |
| 503 | Service unavailable - Trading disabled (cancels still work in cancel-only mode) |
From Polymarket's published OpenAPI spec and rate-limit tables, synced 2026-10-04.