What prevents us removing permissionId as a path param on PUT? Would that be some sort of REST protocol violation?
I notice that you don't include the permission object on DELETE, which I think is the correct way. I think we have some DELETE Resource REST endpoints which include both id and object (within id therein), which is one of those existing issues which I referred to.