When a customer entered incorrect email and password 6 times, customer account is locked.That time api is showing error Unauthorized access. After
lock_expire_time customer account is not unlocked, why? Anybody tell me.
Once your Magento backend url is known by a robot, the robot can hit this url with random data from a dictionary.
If the random attack from the robot happens to have a valid username but incorrect password, the robots would lock the user so that no harm is done with this user.
Also, the user could still use his backend access let's say the following day without having to go in the database and change the lock for instance. Overall, the robot attack would be stopped.
If you do want to unlock your user though, the sql below should enable your access again:
update admin_user set failures_num=0,first_failure=NULL,lock_expires=NULL where username='<username>';