api: add lock to avoid concurrent requests