Switch a recipient between active and inactive.

gateway_locked appears in the status list but is set only by the system. Sending it returns 403 with code GATEWAY_LOCKED_SYSTEM_RESERVED. Any other invalid value returns 400 VALIDATION_ERROR. A recipient that belongs to a different merchant returns 404.

Merchant users work on their own merchant's recipients. Tenant owners and admins can work on any merchant in their tenant by passing ?merchantId=. A merchant in another tenant returns 404. Other roles are refused.

Authenticate with a dashboard session token, or a merchant-pinned secret key in X-API-Key. A secret key acts only for its own merchant: anything it creates belongs to that merchant and records the key as the actor, and another merchant's recipients return 404. Publishable, payout_write and agent_onboarding keys are refused.