application/jsonuser_key. Actions: block, unblock, activate, deactivate. Admin role required.user_key, action (one of the four above)200 - returns { success, message } only (no data).401 - missing/invalid token | 403 - not an admin | 404 - user not found | 422 - invalid action