locks api for token access for update, destroy and create