> ## Documentation Index > Fetch the complete documentation index at: https://finance.dev/llms.txt > Use this file to discover all available pages before exploring further. # List Prediction Mass Cancels > Returns an account's mass cancel requests, newest first, paged. **Use Case:** Show who cancelled an account's orders in bulk, and what the venue answered. This endpoint is in **closed beta**. It is available only to accounts enrolled in the beta, and only on staging (`https://api.tradearies.dev`). Request and response shapes may change before general availability. ## Overview `accountId` is required. Every mass cancel sent for the account is returned, newest first, each in the shape [Get Prediction Mass Cancel](/api-reference/predictions/get-mass-cancel) returns. `requestedBy` is the user who sent it. `limit` sets the page size. It defaults to `50`, and values above `200` are clamped to `200`. Pass the response's `nextCursor` as `cursor` to fetch the next page. `nextCursor` is absent on the last page. ## Example ```bash theme={null} curl -X GET "https://api.tradearies.dev/v1/predictions/orders/mass-cancels?accountId=ACCOUNT-0001&limit=20" \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` ## Errors | Status | `code` | Meaning | | - | - | - | | `400` | `INVALID_LIMIT` | `limit` is not a positive integer. | | `400` | `INVALID_ORDER` | `accountId` is missing, or a malformed `cursor`. | | `401` | — | Missing or invalid credentials. | | `500` | `ORDER_REQUEST_FAILED` | Unexpected server error. | ## OpenAPI ````yaml openapi.json GET /v1/predictions/orders/mass-cancels openapi: 3.0.3 info: contact: email: support@aries.com name: Aries Financial description: >- OpenAPI Specification for the Aries trading platform API. # Authentication Learn how to authenticate with the Aries API using OAuth2 and manage access tokens in your SDK. ## Overview The Aries API uses **OAuth2 with Bearer tokens** (JWT format) for authentication. All API requests require a valid access token in the `Authorization` header: ``` Authorization: Bearer ``` ## Providing Client ID and Client Secret (SDK) When using the generated SDK, provide your **Client ID** and **Client Secret** when you create the API client (e.g. in the constructor or security options). The SDK will use these to obtain and refresh the access token internally; you do not need to manage tokens yourself. Obtain your OAuth2 credentials from the Aries platform (e.g. Client Center / Manage Account at https://app.aries.com): - **Client ID** – Your application identifier (pass to SDK client) - **Client Secret** – Your application secret key (pass to SDK client; use PKCE for public clients where secret cannot be stored) ## Authentication Flow ### 1. Authorization Code Flow For server-side or confidential clients: 1. **Redirect the user** to the authorization URL to sign in and consent: - **URL:** `https://app.aries.com/oauth2/authorize` - **Query params:** `response_type=code`, `client_id`, `redirect_uri`, `scope`, `state` 2. **Exchange the code for tokens** (after user is redirected back with `?code=.`): - **POST** `https://api.aries.com/v1/oauth2/token` - **Body:** `grant_type=authorization_code`, `code`, `redirect_uri`, `client_id`, `client_secret` - Response includes `access_token` and `refresh_token` 3. **Call the API** with the access token: `Authorization: Bearer ` ### 2. PKCE Flow For SPAs and mobile apps (public clients that cannot store `client_secret`): 1. Generate a **code_verifier** (random string) and **code_challenge** = BASE64URL(SHA256(code_verifier)). 2. **Redirect the user** to `https://app.aries.com/oauth2/authorize` with `code_challenge`, `code_challenge_method=S256`, plus `client_id`, `redirect_uri`, `scope`, `state`. 3. **Exchange the code** at POST `https://api.aries.com/v1/oauth2/token` with `grant_type=authorization_code`, `code`, `redirect_uri`, `client_id`, `code_verifier` (no client_secret). 4. Use the returned `access_token` as Bearer. ### 3. MFA Verification If the user has MFA enabled, the authorize step may return `is_mfa: true` and a `next_step_auth_id`. Call **POST** `https://api.aries.com/v1/oauth2/authorize/mfa` with `next_step_auth_id` and `verification_code` (6-digit code). Then continue with **POST** `/v1/oauth2/authorize/confirm` to get the authorization code, and exchange it at `/v1/oauth2/token`. ## Token Management - **Refresh when expired:** POST `https://api.aries.com/v1/oauth2/token` with `grant_type=refresh_token`, `client_id`, `client_secret`, `refresh_token`. - **Using a Bearer token directly:** If you already have an access token, set the header `Authorization: Bearer ` on every request. The SDK can accept a pre-obtained token and use it until it expires. ## OAuth2 Scopes Request only the scopes your application needs. Available scopes: | Scope | Description | |-------|-------------| | `user:information` | View user profile and personal details | | `watchlist:information` | View your watchlists and their symbols | | `watchlist:management` | Create, update, replace, and delete your watchlists | | `account:information` | View account balances, positions, and transaction history | | `order:execution` | Place, modify, and cancel orders | | `order:information` | View order history and status | | `position:information` | View current positions and holdings | | `market:information` | Access live and historical market data | | `calendar:information` | Access earnings, economic, and market schedule data | | `options:information` | Access options chains and expiration data | | `analytics:information` | View analytics, ratings, and market insights | | `market:supplemental` | News, company profiles, financials, filings, ETF data, technical analysis | Specify multiple scopes as a space-separated string, e.g. `account:information order:execution market:information`. ## Security Best Practices - **Store credentials securely** – Use environment variables or a secrets manager for `client_id` and `client_secret`. Never hardcode them. - **Handle token expiration** – Check for 401 responses and refresh the token using the refresh_token, then retry the request. - **Use HTTPS** – All authorization and token endpoints must be called over HTTPS. - **Validate state** – When using the authorization code flow, validate the `state` parameter on the callback to prevent CSRF. ## Error Handling - **400 Bad Request** – Invalid or missing parameters, validation failures, or malformed JSON. Response bodies follow the same patterns as other errors (flat `error` string, optional `codes`, nested `error` object, or rarely no body). - **401 Unauthorized** – Invalid or expired access token; refresh the token or re-authenticate. JSON bodies are not identical on every route: you may see a flat `error` string (sometimes with `codes`), a nested `error` object (`type`, `code`, `message`), or rarely an empty body - **403 Forbidden** – Insufficient scope or permissions for the requested resource. Error JSON may be flat or nested, like 400/401. - **404 Not Found** – Resource does not exist or is not visible. Error JSON may be flat or nested. - **500 / 5xx** – Server or upstream failure; retry with backoff. Do not depend on a single error JSON shape; some responses may have no body. --- Endpoints in this spec: health, OAuth2 (authorize, confirm, mfa, token), users, accounts, orders, market data, watchlist, chart, analytics, calendars, company, economy, financials, indices, options, news, and supplemental data. title: Aries API — OpenAPI Specification version: 1.0.0 servers: - description: Production server url: https://api.aries.com - description: Staging server url: https://api.tradearies.dev security: [] tags: - description: Account management endpoints for positions, orders, and balances name: Accounts - description: >- Analytics endpoints for market data analysis including top gainers, losers, volume leaders, sector analysis, analyst ratings, market breadth, and net inflow name: Analytics - description: Calendar and mergers/acquisitions endpoints name: Calendar - description: Chart endpoints for config, symbols, history, quotes, and server time name: Chart - description: Company profile, executives, peers, and financial metrics name: Company - description: 'Corporate actions: spinoffs, tender offers, IPO calendar, dividends' name: Corporate Actions - description: ETF profile, holdings, sector allocation, and country allocation name: ETF - description: 'Economy endpoints: inflation, inflation expectations, treasury yields' name: Economy - description: SEC filings and filing similarity index name: Filings - description: >- Financials: reported, statements, revenue breakdown, short volume, ratios, short interest name: Financials - description: >- Indices endpoints for groups, list, search, bar, bars, chart-bars, realtime values name: Indices - description: Logos search and sync endpoints name: Logos - description: Market status and market holidays by exchange name: Market - description: >- Market data endpoints for symbol search, real-time data access, and equity details name: Market Data - description: News and news sentiment endpoints name: News - description: >- OAuth2 token issuance: exchange authorization codes, refresh tokens, or client credentials for access tokens name: OAuth2 - description: >- Options endpoints: expiry dates, contracts, activity, trades, quotes, unusual activity name: Options - description: >- Order management endpoints for placing, updating, canceling, and previewing orders name: Orders - description: Company, fund, insider, and institutional ownership data name: Ownership - description: Signals and bull-bear cases name: Signals - description: >- Transcripts, company presentation, social sentiment, investment themes, supply chain, and ESG data name: Stock Alternative - description: >- Analyst price targets, upgrades and downgrades, revenue, EBITDA, EBIT, and EPS estimates, and earnings surprises name: Stock Estimates - description: Stock aggregate bars, daily summaries, snapshots, trades, and quotes name: Stocks - description: >- Technical patterns, support and resistance levels, aggregate technical indicators, and indicator time series name: Technical Analysis - description: Basic information about the authenticated user name: Users - description: >- Watchlist endpoints for listing, creating, updating, and deleting watchlists name: Watchlist - description: Historical YES/NO tick data for prediction-market contracts name: Prediction Historical Data - description: >- Prediction-market reference data and full-text search over base events, events, and contracts name: Prediction Market Data - description: >- Closed beta. Place prediction-market orders and read back the authenticated user's order history. name: Prediction Orders paths: /v1/predictions/orders/mass-cancels: get: tags: - Prediction Orders summary: List prediction mass cancels description: >- **Closed beta.** Available only to accounts enrolled in the prediction-market orders closed beta. Returns the account's mass cancels, newest first, one page at a time. operationId: listPredictionMassCancels parameters: - description: The account. Every order on it is covered, whoever placed it. example: ACCOUNT-0001 in: query name: accountId required: true schema: type: string - description: Mass cancels per page. Values above 200 are clamped to 200. in: query name: limit schema: default: 50 maximum: 200 minimum: 1 type: integer - description: '`nextCursor` from the previous page.' in: query name: cursor schema: type: string responses: '200': content: application/json: schema: allOf: - $ref: '#/components/schemas/PredMdSuccessEnvelope' - properties: data: $ref: '#/components/schemas/PredOrdersMassCancelPage' type: object description: A page of mass cancels. '400': $ref: '#/components/responses/PredOrdersBadRequest' '401': $ref: '#/components/responses/Unauthorized' '500': $ref: '#/components/responses/PredOrdersInternalServerError' security: - OAuth2: [] servers: - description: Staging url: https://api.tradearies.dev components: schemas: PredMdSuccessEnvelope: description: >- Standard success envelope used by all success responses. `data` is endpoint-specific. properties: data: {} success: example: true type: boolean required: - success type: object PredOrdersMassCancelPage: properties: massCancels: items: $ref: '#/components/schemas/PredOrdersMassCancel' type: array nextCursor: description: Absent on the last page. type: string type: object PredOrdersMassCancel: description: >- A mass cancel request and whether the venue accepted it. It does not list the orders canceled: each arrives as an order update. properties: accountId: type: string answeredAt: description: When the venue answered. Absent while `pending`. format: date-time type: string createdAt: format: date-time type: string massCancelId: format: uuid type: string outcome: type: string rejectReason: description: Set when `status` is `rejected`. enum: - not_supported - unknown_security - other - business_reject type: string rejectText: description: The venue's own words. type: string requestType: description: '`all` when no `symbol` was given, otherwise `by_security`.' enum: - all - by_security type: string requestedBy: description: The user who sent the request. type: string sentAt: format: date-time type: string status: description: >- `pending` until the venue answers. `not_sent` means nothing reached the venue. enum: - pending - accepted - rejected - not_sent type: string symbol: type: string totalAffectedOrders: description: The venue's count of orders canceled, when it gives one. type: string type: object PredOrdersErrorEnvelope: properties: error: $ref: '#/components/schemas/PredOrdersAppError' success: example: false type: boolean required: - success - error type: object ErrorResponse: description: >- Flat error body: an `error` string, with optional structured `codes` and additional `metadata`. properties: codes: description: Structured error codes for programmatic handling items: $ref: '#/components/schemas/ErrorCode' type: array error: description: >- Error detail as a string. Exact message content is not fixed and should not be hard-coded. example: string type: string metadata: additionalProperties: true description: Additional error context type: object type: object AuthenticationErrorEnvelope: description: >- JSON envelope where `error` is a nested object (`type`, `code`, `message`, …). Many services use this shape for 400, 401, 403, 404, and 5xx when using the shared HTTP error format. properties: error: $ref: '#/components/schemas/AuthenticationErrorDetail' meta: additionalProperties: true description: Optional metadata type: object type: object PredOrdersAppError: description: Structured error returned by the prediction-market order endpoints. properties: code: description: >- Machine-readable code, e.g. `INVALID_ORDER`, `ORDER_OUTCOME_UNKNOWN`. Branch on this. example: INVALID_ORDER type: string details: additionalProperties: true type: object message: description: >- Human-readable detail. Exact text is not fixed and should not be matched on. example: string type: string request_id: type: string type: description: Categorical error type, in lowercase. enum: - bad_request - authentication - not_found - conflict - rate_limit - unavailable - timeout - internal example: bad_request type: string required: - type - code - message type: object ErrorCode: description: >- A single structured error entry identifying a machine-readable code, a human-readable description, and optionally the field that caused it. properties: code: description: Machine-readable error code example: INVALID_PASSWORD type: string description: description: Human-readable description of the error example: Password must be between 8 and 64 characters type: string field: description: Field name that caused the error example: password type: string type: object AuthenticationErrorDetail: description: >- Structured payload for the nested `error` object. Services using the shared Go error writer emit uppercase `type` values aligned with error categories (for example `VALIDATION`, `BAD_REQUEST`, `AUTHENTICATION`, `AUTHORIZATION`, `NOT_FOUND`, `RATE_LIMIT`, `INTERNAL`). properties: code: description: Machine-readable code example: INVALID_TOKEN type: string details: additionalProperties: true description: Optional extra context type: object message: description: >- Error detail as a string. Exact message content is not fixed and should not be hard-coded. example: string type: string request_id: description: Request correlation id when provided type: string type: description: >- Error category emitted by the shared error writer, such as VALIDATION, BAD_REQUEST, AUTHENTICATION, AUTHORIZATION, NOT_FOUND, RATE_LIMIT, or INTERNAL. example: AUTHENTICATION type: string type: object responses: PredOrdersBadRequest: content: application/json: example: error: code: INVALID_ORDER message: string type: bad_request success: false schema: $ref: '#/components/schemas/PredOrdersErrorEnvelope' description: >- Invalid request. `INVALID_ORDER` carries the reason in `message`; on placement this includes refusals from order entry and the venue (price, tick size, account setup). Unauthorized: content: application/json: examples: flat_message: summary: Flat error string (typical) value: error: string flat_with_codes: summary: Flat error with structured codes value: codes: - code: string description: string error: string nested_error_object: summary: Nested error (shared HTTP error format) value: error: code: INVALID_TOKEN message: string type: AUTHENTICATION schema: description: >- 401 responses may use a flat `ErrorResponse` shape or a nested `error` object. Inspect `error`: if it is a string, use the flat shape; if it is an object, use the structured shape. oneOf: - $ref: '#/components/schemas/ErrorResponse' - $ref: '#/components/schemas/AuthenticationErrorEnvelope' description: >- Authentication failed: missing credentials, invalid JWT, or expired access token. **Response body variants:** Some routes return JSON with a string `error` field (and optionally `codes` / `metadata`). Others return JSON where `error` is a structured object (`type`, `code`, `message`, and optionally `details`, `request_id`). In edge cases (for example certain gateway or middleware paths) the response may have **no body** even though the status is 401—clients should treat 401 as unauthenticated and refresh or re-authenticate regardless of body shape. PredOrdersInternalServerError: content: application/json: example: error: code: ORDER_REQUEST_FAILED message: the order request failed type: internal success: false schema: $ref: '#/components/schemas/PredOrdersErrorEnvelope' description: Unexpected server error. securitySchemes: OAuth2: description: >- OAuth2 Bearer token: obtain an access token from the token endpoint and send it in the Authorization header. flows: authorizationCode: authorizationUrl: https://app.aries.com/oauth2/authorize refreshUrl: https://api.aries.com/v1/oauth2/token scopes: account:information: View account balances, positions, and transaction history analytics:information: View analytics, ratings, and market insights calendar:information: Access earnings, economic, and market schedule data market:information: Access live and historical market data market:supplemental: >- News, company profiles, financials, filings, ETF data, technical analysis options:information: Access options chains and expiration data order:execution: Place, modify, and cancel orders order:information: View order history and status position:information: View current positions and holdings user:information: View user profile and personal details user:management: Manage user-scoped resources and saved configuration (internal). watchlist:information: View your watchlists and their symbols. watchlist:management: Create, update, replace, and delete your watchlists. tokenUrl: https://api.aries.com/v1/oauth2/token clientCredentials: refreshUrl: https://api.aries.com/v1/oauth2/token scopes: account:information: View account balances, positions, and transaction history analytics:information: View analytics, ratings, and market insights calendar:information: Access earnings, economic, and market schedule data market:information: Access live and historical market data market:supplemental: >- News, company profiles, financials, filings, ETF data, technical analysis options:information: Access options chains and expiration data order:execution: Place, modify, and cancel orders order:information: View order history and status position:information: View current positions and holdings user:information: View user profile and personal details user:management: Manage user-scoped resources and saved configuration (internal). watchlist:information: View your watchlists and their symbols. watchlist:management: Create, update, replace, and delete your watchlists. tokenUrl: https://api.aries.com/v1/oauth2/token type: oauth2 ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.