lock_file_batch prevents file from being edited in the web but the API still can

Hi everyone! Hope you're having a great day 😀

I'm testing the lock functionality using two accounts; one is the owner of a shared folder and another is the user of that folder; sees it and uploads things inside.

So the thing I'd like to achieve is that after the user uploads a file to the folder that user can't delete it.

I've tested uploading with the user account token, and then locking with the lock_file_batch endpoint using the owner token, and when I see that file logged as the user, in the Dropbox web ui the actions for delete, rename and move are disabled, but when I use the API with a user token, I still am able to delete the file.

Is this normal and I didn't understand something right?

Thanks in advance.