Capital.com API PUT /api/v1/workingorders/{dealId}
Amend a LIMIT or STOP working order: its price level, cancellation date, stop loss or take profit.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
Listed as Update working order in Capital.com's official Postman collection (opened on the date shown), with its body parameters and examples. The reference at open-api.capital.com documents this call too, with the same body fields, each marked as not required. Method, path and request parameters were re-read on open-api.capital.com on 12 Oct 2026 and agree with this record; the mock reply was not compared field by field.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| dealIdrequired | path | string | Permanent deal ID of the working order to amend. Mock value shown. |
| level | body | number | Order price. |
| goodTillDate | body | string | Cancellation date in UTC, format YYYY-MM-DDTHH:MM:SS. Leave out for good till cancelled. |
| guaranteedStop | body | boolean | True for a guaranteed stop. Then set stopLevel, stopDistance or stopAmount. Not allowed with trailingStop or in hedging mode. |
| trailingStop | body | boolean | True for a trailing stop. Then set stopDistance. Not allowed with guaranteedStop. |
| stopLevel | body | number | Price at which the stop loss triggers. |
| stopDistance | body | number | Distance from the current price to the stop loss. Required when trailingStop is true. |
| stopAmount | body | number | Loss amount at which the stop loss triggers. |
| profitLevel | body | number | Price at which the take profit triggers. |
| profitDistance | body | number | Distance from the current price to the take profit. |
| profitAmount | body | number | Profit amount at which the take profit triggers. |
Authentication headers
| Name | Type | Description |
|---|---|---|
| CSTrequired | string | Access token returned in the CST response header of POST /session. Valid for 10 minutes after last use. Placeholder only. |
| X-SECURITY-TOKENrequired | string | Account token returned in the X-SECURITY-TOKEN response header of POST /session. It selects the financial account. Placeholder only. |
Request
Written from the method, path and parameters recorded on this page, against the demo host. Not executed against a live or demo account. Credentials are read from environment variables on your own machine and are never entered on this site. The request builder writes these same snippets, from the same record.
This call takes a request body. The record marks no body field as required, so the samples send an empty JSON object with a Content-Type of application/json (in Python, passing json= sets that header). Add the fields the call needs from the parameters above before the request can succeed.
Python
# Set CAPITAL_CST, CAPITAL_SECURITY_TOKEN as environment variables first. Never paste real values into code.
# CAPITAL_CST and CAPITAL_SECURITY_TOKEN hold the CST and X-SECURITY-TOKEN headers that POST /api/v1/session returns: step 3 of the quickstart (/brokers/capital-com/quickstart#step-3) captures them and this sample reads them back.
# Replace each {placeholder}, "..." and 0 with a real value before running.
# Optional and not shown: body fields level, goodTillDate, guaranteedStop, trailingStop, stopLevel, stopDistance, stopAmount, profitLevel, profitDistance, profitAmount.
import os
import requests
BASE_URL = "https://demo-api-capital.backend-capital.com" # the demo host
headers = {
"CST": os.environ["CAPITAL_CST"],
"X-SECURITY-TOKEN": os.environ["CAPITAL_SECURITY_TOKEN"],
}
body = {}
resp = requests.put(BASE_URL + "/api/v1/workingorders/{dealId}", headers=headers, json=body, timeout=10)
resp.raise_for_status()
print(resp.json())JavaScript
// Set CAPITAL_CST, CAPITAL_SECURITY_TOKEN as environment variables first. Never paste real values into code.
// CAPITAL_CST and CAPITAL_SECURITY_TOKEN hold the CST and X-SECURITY-TOKEN headers that POST /api/v1/session returns: step 3 of the quickstart (/brokers/capital-com/quickstart#step-3) captures them and this sample reads them back.
// Replace each {placeholder}, "..." and 0 with a real value before running.
// Optional and not shown: body fields level, goodTillDate, guaranteedStop, trailingStop, stopLevel, stopDistance, stopAmount, profitLevel, profitDistance, profitAmount.
// Run as a module, for example a .mjs file, on a Node version that has fetch built in.
const BASE_URL = "https://demo-api-capital.backend-capital.com"; // the demo host
const res = await fetch(BASE_URL + "/api/v1/workingorders/{dealId}", {
method: "PUT",
headers: {
"CST": process.env.CAPITAL_CST,
"X-SECURITY-TOKEN": process.env.CAPITAL_SECURITY_TOKEN,
"Content-Type": "application/json",
},
body: JSON.stringify({}),
});
if (!res.ok) throw new Error(`HTTP ${res.status}`);
console.log(await res.json());curl
# Set CAPITAL_CST, CAPITAL_SECURITY_TOKEN as environment variables first. Never paste real values into code.
# CAPITAL_CST and CAPITAL_SECURITY_TOKEN hold the CST and X-SECURITY-TOKEN headers that POST /api/v1/session returns: step 3 of the quickstart (/brokers/capital-com/quickstart#step-3) captures them and this sample reads them back.
# Replace each {placeholder}, "..." and 0 with a real value before running.
# Optional and not shown: body fields level, goodTillDate, guaranteedStop, trailingStop, stopLevel, stopDistance, stopAmount, profitLevel, profitDistance, profitAmount.
curl -X PUT "https://demo-api-capital.backend-capital.com/api/v1/workingorders/{dealId}" \
-H "CST: $CAPITAL_CST" \
-H "X-SECURITY-TOKEN: $CAPITAL_SECURITY_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'Response
A mock response. The values are invented, so check field names against the official reference.
{
"_mock": true,
"dealReference": "o_MOCK-REF-0002"
}Response schema, HTTP 200
Every field this site's OpenAPI file for Capital.com declares for this response.
| Field | Type | Description |
|---|---|---|
| dealReference | string | Not recorded |
Unverifiedno source opened This schema is not sourced to a page of the provider's own that we opened, so check field names against the official reference.
Limits that apply at Capital.com
| Limit | Value | Scope | Source |
|---|---|---|---|
| Headline limit | 10/s per user | user | open-api.capital.comchecked |
Capital.com API errors you may meet
- error.account.limit.reachedHTTP 400. The demo account's balance cap has been reached, so it cannot be topped up further.
- error.invalid.accountHTTP 400. The account selected for a demo balance top up is not valid.
- error.invalid.accountIdHTTP 400. The account id sent when switching the active account is not valid.
- error.invalid.amountHTTP 400. The amount in a demo balance top up request is not valid.
- error.invalid.detailsHTTP 401. Invalid credentials on session creation.
- error.invalid.fromHTTP 400. The from parameter of an activity history request is not valid.
All Capital.com API error codes, including 18 more not listed here.