I spent quite some time to figure this out so I thought I’ll share it for the next person who want to do this: suspend a user via the API.
If you use Discourse web interface, you can go to the route /admin/users/:username and then use the suspend button. You can find the suspend method in UsersController. Well turns out that you should not use :username in the route but the user_id.
To conclude, to disable a user via the API, use /admin/users/:user_id/suspend