Create Folder Lock API permissions

Hi, I created a platform App using OAuth 2.0.  I created a website that allows a user to login to Box, then use the Box API to list all the folders that the user owns.  I use the Create folder lock endpoint to allow the user to lock/unlock a folder.  However I always get an Authorization failed when trying to lock/unlock.  The app has both read and write permissions.  Are there other settings I need to set ?  Thanks.