Your API Needs a Lockfile