This is misleading and a bit dangerous... You'd also need to "sync" the lock resource, which is accessed over REST. At the very least, you need some sort of Id

This is misleading and a bit dangerous... You'd also need to "sync" the lock resource, which is accessed over REST. At the very least, you need some sort of Idempotency-Key for your REST API. (Imagine the scenario where /acquire succeeds on the server, but the network response fails before the client gets to read it. The client retries. How does the server know it's the same request?)