I had internal debate on this point.  It seems plausible to do as you suggest, but seems equally plausible that the client would call the delete endpoint in hopes of deleting (removing) permissions.  The fact that behind the scenes we just change the status is irrelevant to the client.

It's the same as calling the delete end point for conferences, but rather than delete it, we'd set a flag "archive" = true.