In DSpace 6, when visiting a withdrawn item, the user receives a message stating the item is withdrawn. Admins will still be able to edit the item though
In DSpace 7, regular users will receive a forbidden or unauthorized when visiting a withdrawn item. There's no way to identify whether the item was withdrawn or private.
Since the forbidden or unauthorized is applicable, there's no JSON response to include that status. A response header may be used instead (similar to the response header of the login REST endpoint)