# Block or restore a client (/docs/api-reference/reseller-clients/setClientAccess) > Block a client, or restore one you blocked. Nothing is deleted, so the client's agents, numbers, campaigns and history stay as they are and a restore brings the client back as it was. > **Reseller accounts only.** [Request access](https://omnidim.io/contact-us?reason=reseller_api&lock=1). **POST** `/reseller/users/access` Block a client, or restore one you blocked. Nothing is deleted, so the client's agents, numbers, campaigns and history stay as they are and a restore brings the client back as it was. Name the target with exactly one of `user_id` (one user) or `organization_id` (every user in a client organization). Both must be your direct clients. Block (`blocked: true`): the client is signed out and its API keys stop working at once. Users that are already blocked by their own organization admin, or whose account has expired, are left as they are. The owner of a client organization can only be blocked together with the whole organization: send `organization_id`. Restore (`blocked: false`): lifts only the blocks you made, and clears an expiry date that passed while the client was blocked. Restoring a user you did not block returns `409`. `detach_numbers` (only with `organization_id` and `blocked: true`) also detaches the organization's phone numbers from their agents, so nothing answers on them. The response lists what was detached in `detached_numbers`, so you can attach them again. Who may call: a reseller key. Any other key gets `403`. Errors: `400 invalid_request` when `blocked` or `detach_numbers` is not a JSON boolean, when `user_id` and `organization_id` are both sent or both missing, when an id is not an integer, or when `detach_numbers` is used without `organization_id` or with `blocked: false`. `401` for a missing or invalid key. `403 forbidden` when the key is not a reseller's, or when you block a user who owns a client organization by `user_id`. `404 not_found` when the user or organization is not your client. A client that belongs to someone else gives the same answer as one that does not exist. `409 conflict` when you restore a user you did not block. ```yaml operationId: setClientAccess requestBody: required: true content: application/json: schema: type: object required: - blocked properties: blocked: type: boolean description: '`true` blocks, `false` restores. Must be a JSON boolean.' user_id: type: integer description: The client user to block or restore. Send this or `organization_id`, not both. organization_id: type: integer description: >- The client organization whose users are all blocked or restored. Send this or `user_id`, not both. detach_numbers: type: boolean default: false description: | Also detach the organization's numbers from their agents. Only with `organization_id` and `blocked: true`. example: blocked: true organization_id: 5678 detach_numbers: true responses: '200': description: Access changed. content: application/json: schema: type: object properties: success: type: boolean blocked: type: boolean description: The state you asked for. user_ids: type: array items: type: integer description: The users whose access changed. Users that were left as they were are not listed. detached_numbers: type: object description: | Numbers detached from their agents, keyed by number id. Empty unless `detach_numbers` was true. Use it to attach the numbers again. additionalProperties: type: object properties: agent_id: type: integer sms_enabled: type: boolean message: type: string example: success: true blocked: true user_ids: - 1234 - 1235 detached_numbers: '91': agent_id: 412 sms_enabled: false message: Client access blocked. '400': description: The body is not valid. `error_description` says what to fix. content: application/json: schema: type: object properties: error: type: string description: Machine-readable error code. error_description: type: string description: Human-readable explanation. code: type: string description: | Stable, specific reason. Present on the newer endpoints (Voice cloning, WhatsApp); older endpoints return only `error`. request_id: type: string description: | Correlates this response with the server log. Present alongside `code`. Also sent as the `X-Request-Id` header. example: error: invalid_request error_description: Send user_id or organization_id, not both. '401': description: Missing or invalid API key. '403': description: | The key is not a reseller's, or you tried to block the owner of a client organization by `user_id`. content: application/json: schema: type: object properties: error: type: string description: Machine-readable error code. error_description: type: string description: Human-readable explanation. code: type: string description: | Stable, specific reason. Present on the newer endpoints (Voice cloning, WhatsApp); older endpoints return only `error`. request_id: type: string description: | Correlates this response with the server log. Present alongside `code`. Also sent as the `X-Request-Id` header. example: error: forbidden error_description: This user owns the client organization. Block the organization instead. '404': description: The user or organization is not one of your clients. content: application/json: schema: type: object properties: error: type: string description: Machine-readable error code. error_description: type: string description: Human-readable explanation. code: type: string description: | Stable, specific reason. Present on the newer endpoints (Voice cloning, WhatsApp); older endpoints return only `error`. request_id: type: string description: | Correlates this response with the server log. Present alongside `code`. Also sent as the `X-Request-Id` header. example: error: not_found error_description: User not found. '409': description: You tried to restore a user you did not block. content: application/json: schema: type: object properties: error: type: string description: Machine-readable error code. error_description: type: string description: Human-readable explanation. code: type: string description: | Stable, specific reason. Present on the newer endpoints (Voice cloning, WhatsApp); older endpoints return only `error`. request_id: type: string description: | Correlates this response with the server log. Present alongside `code`. Also sent as the `X-Request-Id` header. example: error: conflict error_description: This user was not blocked by you. Their organization admin can restore them. ``` **Python SDK** ```python from omnidimension import Client client = Client(api_key) # Block one client user, then restore them. client.reseller.set_client_access(blocked=True, user_id=1234) client.reseller.set_client_access(blocked=False, user_id=1234) # Block a whole client organization and detach its numbers. response = client.reseller.set_client_access( blocked=True, organization_id=5678, detach_numbers=True, ) print(response["json"]["detached_numbers"]) ``` **curl** ```bash curl -X POST "https://backend.omnidim.io/api/v1/reseller/users/access" \ -H "Authorization: Bearer $OMNIDIM_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "blocked": true, "organization_id": 5678, "detach_numbers": true }' ```