diff --git a/plugins/catalog-backend/src/service/createRouter.test.ts b/plugins/catalog-backend/src/service/createRouter.test.ts
index 240cc022c6..205be01b42 100644
--- a/plugins/catalog-backend/src/service/createRouter.test.ts
+++ b/plugins/catalog-backend/src/service/createRouter.test.ts
@@ -265,6 +265,33 @@ describe('createRouter readonly disabled', () => {
     });
   });
 
+  describe('GET /locations/:id', () => {
+    it('happy path: gets location by id', async () => {
+      const location: Location = {
+        id: 'foo',
+        type: 'url',
+        target: 'example.com',
+      };
+      locationService.getLocation.mockResolvedValueOnce(location);
+
+      const response = await request(app)
+        .get('/locations/foo')
+        .set('authorization', 'Bearer someauthtoken');
+
+      expect(locationService.getLocation).toHaveBeenCalledTimes(1);
+      expect(locationService.getLocation).toHaveBeenCalledWith('foo', {
+        authorizationToken: 'someauthtoken',
+      });
+
+      expect(response.status).toEqual(200);
+      expect(response.body).toEqual({
+        id: 'foo',
+        target: 'example.com',
+        type: 'url',
+      });
+    });
+  });
+
   describe('POST /locations', () => {
     it('rejects malformed locations', async () => {
       const spec = {
@@ -337,6 +364,23 @@ describe('createRouter readonly disabled', () => {
       );
     });
   });
+
+  describe('DELETE /locations', () => {
+    it('deletes the location', async () => {
+      locationService.deleteLocation.mockResolvedValueOnce(undefined);
+
+      const response = await request(app)
+        .delete('/locations/foo')
+        .set('authorization', 'Bearer someauthtoken');
+
+      expect(locationService.deleteLocation).toHaveBeenCalledTimes(1);
+      expect(locationService.deleteLocation).toHaveBeenCalledWith('foo', {
+        authorizationToken: 'someauthtoken',
+      });
+
+      expect(response.status).toEqual(204);
+    });
+  });
 });
 
 describe('createRouter readonly enabled', () => {
@@ -430,6 +474,33 @@ describe('createRouter readonly enabled', () => {
     });
   });
 
+  describe('GET /locations/:id', () => {
+    it('happy path: gets location by id', async () => {
+      const location: Location = {
+        id: 'foo',
+        type: 'url',
+        target: 'example.com',
+      };
+      locationService.getLocation.mockResolvedValueOnce(location);
+
+      const response = await request(app)
+        .get('/locations/foo')
+        .set('authorization', 'Bearer someauthtoken');
+
+      expect(locationService.getLocation).toHaveBeenCalledTimes(1);
+      expect(locationService.getLocation).toHaveBeenCalledWith('foo', {
+        authorizationToken: 'someauthtoken',
+      });
+
+      expect(response.status).toEqual(200);
+      expect(response.body).toEqual({
+        id: 'foo',
+        target: 'example.com',
+        type: 'url',
+      });
+    });
+  });
+
   describe('POST /locations', () => {
     it('is not allowed', async () => {
       const spec: LocationSpec = {
@@ -475,6 +546,17 @@ describe('createRouter readonly enabled', () => {
       );
     });
   });
+
+  describe('DELETE /locations', () => {
+    it('is not allowed', async () => {
+      const response = await request(app)
+        .delete('/locations/foo')
+        .set('authorization', 'Bearer someauthtoken');
+
+      expect(locationService.deleteLocation).not.toHaveBeenCalled();
+      expect(response.status).toEqual(403);
+    });
+  });
 });
 
 describe('NextRouter permissioning', () => {