Idempotent — a never-existed or already-terminal id returns 200 with status=not_found, NOT 404. Authentication scope is checked against the order owner, not the JWT wallet alone.
Partner / integrator key — format ps_live_<keyId>_<secret>. Issued by PredictStreet ops via the admin panel; never self-service. Never ship to a browser. multi_wallet partners must additionally send X-User-Wallet: 0x<40-hex> on every authenticated request to declare the acting wallet. See the API keys guide for scope taxonomy, partner kinds, rate limits, and rotation procedure.
Required for multi_wallet partners on every authenticated request; ignored for single_wallet. Declares the acting end-user wallet for this request — drives KYC checks, balances/positions/orders attribution, rate-limit buckets, and audit. Lower-cased server-side. Missing on a multi_wallet key → 401 api_key_user_wallet_required; malformed → 401 api_key_user_wallet_invalid. The on-chain CTFExchange/Vault contracts still verify EIP-712 signer ↔ vault binding, so loosening API-layer attribution is safe by construction.
^0x[a-fA-F0-9]{40}$"0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb3"
Server-side order id (echoes the request).
Cancel outcome. not_found is returned (200, NOT 404) when the id never existed for this wallet OR was already terminal — keeps the cancel call idempotent (audit M6).
cancelled, not_found Quantity that was still unfilled at cancel time (only set when status=cancelled).