Locations

Location authority is an intersection:

approved application scopes
        + merchant-granted scopes
        + token scopes
        + explicit granted locations
        + endpoint and domain policy

A route parameter selects a resource; it never creates authority. Location-owned collections only return granted locations, and inaccessible members fail closed with the same non-enumerating 404 used for nonexistent IDs.

Grants are snapshots. Locations created after authorization are not included. The merchant owner must reauthorize an OAuth application to change its location authority.