API spec for account lockout