render HTML based on REST API permissions
Your approach (having a separate permissions endpoint) is a good way to handle this.
Another alternative is to use a hypermedia format like HAL or Siren. Whenever you access any resource, that resource will include a list of links with information about what the user might want to do next. If a link doesn't appear in a response, the implication is that the user can't perform that action (due to permission issues or otherwise).