I need to create multi websites on the same client account but I need no website can access the other sites
so if one site is hacked, are the other sites still safe?
if this is available
1- is that prevent only PHP scripts or also shell scripts?
2- most of the website will be created through the API, is that available to this feature through the API?
open_basedir can be configured by editing php.ini from admin or enduser panel. This will affect only php scripts and not shell scripts.
However the settings will be per account not per domain so if you want to secure sites for different clients you should create a separate account per client/domain.