question

The Server and Admin API calls are identical, so I'll use the Server API links in this case, but the same applies to both:

The call itself (https://api.playfab.com/documentation/server/method/BanUsers) has one required field - Bans, which is a list (array) of players to ban. Each element of that array is a BanRequest (https://api.playfab.com/documentation/Server/datatype/PlayFab.Server.Models/PlayFab.Server.Models.BanRequest). In the BanRequest, the only required field is the PlayFab ID of the user, though leaving the DurationInHours blank results in a permanent ban, so you'll want to make use of that if you only want the player banned for a short period. So, if you only wanted to ban one user permanently, and their PlayFab ID was 1234567890, the call would be like so:

POST /Server/BanUsers HTTP/1.1
Host: {TitleId}.playfabapi.com
Content-Type: application/json
X-SecretKey: {SecretKey}
{
  "Bans": [
    {
      "PlayFabId": "1234567890"
    }
  ]
}

If you have the user's IP or MAC Address, you can additionally use those for the ban, to try to prevent the user from creating a new account and continuing to access your title. The Reason is solely for your internal use, as it will not be returned to the player when they get the account banned error (when trying to make any Client API call while banned).