When I fire this call, Discourse responds to me with {locked: false}.
I tried locking the post manually and inspecting the API call that the Discourse client makes, and it looks very similar to the one I make from my application, with the exception of the authentication method, perhaps.
The API to lock a post is documented here Discourse API Docs but yeah, I also tried to reverse engineer how the Discourse client does it, and it looks very similar to the way I’m doing it from my application.
That means that you would need to send "locked": "true" and not "locked": true and that the documentation or code would need to be updated to reflect or change this behavior.
The browser does not send a JSON request, it sends Content-Type: application/x-www-form-urlencoded which will interpret the parameter as a string, and that is why it does work in the browser.