```php
<?php

require_once '../../core/api_bootstrap.php';

require_once '../../core/employee_auth.php';
EmployeeAuth::check('edit_leads');

$data = Request::post();

try {

    Validator::required($data,[
        'lead_id',
        'status'
    ]);

    $db = new Database();
    $conn = $db->connect();

    $query = "

        UPDATE customer_leads

        SET status = :status

        WHERE id = :lead_id

    ";

    $stmt = $conn->prepare($query);

    $stmt->execute([

        ':status'=>$data['status'],
        ':lead_id'=>$data['lead_id']

    ]);


    Response::success([],"Lead status updated");

}
catch(Exception $e){

    Logger::log("system.log",$e->getMessage());
    Response::error("Server error",500);

}