General recommendation: use UI and set permission via UI + watch API calls in the browser console and then just replicate them in your code. Print also API response status code, not only response text in your code. And of course read them.
You complain that your code is not working, but you didn’t show your response status codes, text when it is not working.
And please format code, texts when you are posting them here.