lock down api