There is not necessarily any relation between the locale list in zanata.xml and the project/iteration's locale list on the server.  But it would be useful to allow project maintainers to modify the project (or iteration) locale list via REST.  That way,
  mvn zanata:push-locales [-Dzanata.target=version]
would synchronise the project iteration's locale list with the <locales> list in zanata.xml

And
  mvn zanata:push-locales -Dzanata.target=project
would push the locale list to the project, and mark the project iteration as inheriting its locale list from the project (rather than customising the list).

Any locales which have not been enabled by the server admin would be disallowed.

We could also add -Dzanata.target=server which would allow admin to add new locales and/or enable disabled ones.