Is it possible to prevent a user from logging in by updating the state field via my projects admin api? Or do I need to handle this downstream (in my app)?

you're probably looking for https://www.ory.sh/docs/identities/model/activate-deactivate-user-login-state

Ah, we adjusted the identity directly. But will try that! Thank you!