curl -sS -X POST 'https://matrix.example.com/_matrix/client/v3/rooms/!abc123:example.com/kick' -H "Authorization: Bearer $ACCESS_TOKEN" -d '{"user_id":"@bob:example.com","reason":"spam"}'

Removes the user from the room; they can rejoin later if the join rules allow it. Requires sufficient power level in the room, usually moderator or admin. The reason is visible in the room's membership history. Pair with a ban to prevent rejoining, or the admin suspend endpoint to stop them messaging everywhere.