Hi,
BO IAMUsrListController is a controller object, which is only used by application and not exposed for external use, it's PSM status is also not released, there won't by any other object like webservice built on such controller object, so you cannot use this BO.
I doubt if any webservice exposes locked field, may be you will have to check if IDENTITY BO provides such information, or contact application team to check if it is exposed.
You could also have a look at SDK -> Repository explorer -> Inbound service interface to check all the webservice.
Thanks, Pradeep.