create a single API route for locking/unocking