> ## Documentation Index > Fetch the complete documentation index at: https://docs.portalhq.io/llms.txt > Use this file to discover all available pages before exploring further. # Disable or enable signing for a sub-custodian > Disables or re-enables a single capability for every client of a sub-custodian owned by the authenticated reseller, across all of its environments. Disabling the `SIGN` capability blocks every signing request from the sub-custodian's clients, even when the request carries a valid client API key or client session token. Unlike suspending the sub-custodian, this leaves its dashboard, Portal API keys and client authentication working, so clients can still back up, recover and eject their wallets. Use it when a sub-custodian should stop transacting but keep access to its wallets, for example while a payment is outstanding. Re-enable signing by sending the same request with `disabled: false`. The custodian-level setting is independent of per-client capabilities set by the sub-custodian itself: clearing it does not re-enable a client the sub-custodian froze individually. Only the reseller can change this setting. The current state is returned in `disabledCapabilities` on every sub-custodian object, including the **List sub-custodians** response. ## OpenAPI ````yaml /openapi/reseller-api.yaml patch /resellers/custodians/{custodianId}/capabilities openapi: 3.1.0 info: title: Portal Reseller API version: '3.0' description: > The Portal Reseller API lets approved reseller custodians create and manage sub-custodians. Reseller API keys are environment-agnostic and authenticate the reseller custodian. Sub-custodian Portal API keys created through this API are scoped to a specific sub-custodian environment. ## Base URL `https://api.portalhq.io/api/v3` ## Authentication Include your Reseller API key as a Bearer token in the `Authorization` header of every request. servers: - url: https://api.portalhq.io/api/v3 description: Production security: - bearerAuth: [] tags: - name: Reseller Statistics description: View aggregate and per-sub-custodian usage statistics - name: Sub-Custodians description: Create, list, suspend, and reactivate sub-custodians - name: Sub-Custodian Environments description: View environments for sub-custodians - name: Sub-Custodian API Keys description: Create and delete sub-custodian Portal API keys paths: /resellers/custodians/{custodianId}/capabilities: patch: tags: - Sub-Custodians summary: Disable or enable signing for a sub-custodian description: > Disables or re-enables a single capability for every client of a sub-custodian owned by the authenticated reseller, across all of its environments. Disabling the `SIGN` capability blocks every signing request from the sub-custodian's clients, even when the request carries a valid client API key or client session token. Unlike suspending the sub-custodian, this leaves its dashboard, Portal API keys and client authentication working, so clients can still back up, recover and eject their wallets. Use it when a sub-custodian should stop transacting but keep access to its wallets, for example while a payment is outstanding. Re-enable signing by sending the same request with `disabled: false`. The custodian-level setting is independent of per-client capabilities set by the sub-custodian itself: clearing it does not re-enable a client the sub-custodian froze individually. Only the reseller can change this setting. The current state is returned in `disabledCapabilities` on every sub-custodian object, including the **List sub-custodians** response. operationId: updateSubCustodianCapability parameters: - $ref: '#/components/parameters/custodianId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateSubCustodianCapabilityRequest' example: capability: SIGN disabled: true responses: '200': description: Capability updated successfully content: application/json: schema: $ref: '#/components/schemas/SubCustodian' example: id: custodian_123 name: Acme Payments slug: acme-payments billingStatus: ACTIVE disabledCapabilities: - SIGN isReseller: false resellerParentId: reseller_custodian_123 sessionTokensEnabled: true createdAt: '2026-07-08T18:00:00.000Z' updatedAt: '2026-09-01T18:15:00.000Z' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: parameters: custodianId: name: custodianId in: path required: true description: The ID of a sub-custodian owned by the authenticated reseller. schema: type: string schemas: UpdateSubCustodianCapabilityRequest: type: object required: - capability - disabled properties: capability: $ref: '#/components/schemas/ClientCapability' disabled: type: boolean description: >- Set to `true` to disable the capability for every client of the sub-custodian, `false` to re-enable it. SubCustodian: type: object properties: id: type: string name: type: string slug: type: string billingStatus: type: string enum: - ACTIVE - HACKATHON - INACTIVE - INTERNAL - SUSPENDED - TRIAL disabledCapabilities: type: array description: > Capabilities the reseller has disabled for every client of this sub-custodian. Set with **Disable or enable signing for a sub-custodian**. items: $ref: '#/components/schemas/ClientCapability' isReseller: type: boolean resellerParentId: type: string nullable: true sessionTokensEnabled: type: boolean createdAt: type: string format: date-time updatedAt: type: string format: date-time billingPlan: $ref: '#/components/schemas/BillingPlan' environments: type: array items: $ref: '#/components/schemas/Environment' users: type: array items: $ref: '#/components/schemas/User' apiKeys: type: array items: $ref: '#/components/schemas/SubCustodianApiKeyMetadata' ClientCapability: type: string description: >- A client capability that can be disabled. `SIGN` covers every signing request. enum: - SIGN BillingPlan: type: object properties: name: type: string Environment: type: object properties: id: type: string name: type: string enum: - Development - Production alertWebhooksEnabled: type: boolean description: Whether Alert webhooks are enabled for the environment. createdAt: type: string format: date-time updatedAt: type: string format: date-time User: type: object properties: id: type: string email: type: string format: email firstName: type: string nullable: true lastName: type: string nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time SubCustodianApiKeyMetadata: type: object properties: id: type: string custodianId: type: string environmentId: type: string name: type: string createdAt: type: string format: date-time updatedAt: type: string format: date-time ErrorResponse: type: object properties: error: type: string responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Unauthorized - invalid or missing Reseller API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Forbidden - the authenticated custodian is not allowed to perform this action content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: Reseller API Key description: Reseller API key created in the Portal dashboard. ````