Do I need to lock a SQL update query with an “is null” check?

Question

I have an API endpoint that can be called multiple times (in theory), even though it should be only called once.

The API endpoint basically just performs an update op