List of permissions needed for SharePoint REST calls

Question

I do a lot of SharePoint online work using REST calls. I often hit roadblocks when I get "access denied" type errors when code executes from different users.

Question) Basically is there a nice big list of SharePoint REST calls and the required permission level for a user to execute it?

For instance POST ListItemAllFields/breakroleinheritance requires Full Control on the item (I think) POST x requires y permissions

It would be so handy if MSDN or someone had a big list like this so developers can easily set the permissions of users correctly (without giving too much permission)

Question part 2) is Full Control the minimum permission level require to execute ListItemAllFields/breakroleinheritance? I think so from this article but it talks about add-in permissions (https://msdn.microsoft.com/en-us/library/office/dn495392(v=office.15).aspx)

Code:

$.ajax({
        url: "/sites/blah/_api/web/getfilebyserverrelativeurl('/sites/blah/Shared%20Documents/"+ docname +"')/ListItemAllFields/breakroleinheritance(false)",
        type: 'POST',
        headers: { 'X-RequestDigest':$('#__REQUESTDIGEST').val() },
            success: function (dataX) {
                alert(JSON.stringify(dataX));
            },
            error: function (dataX) {
                alert('FAIL' + JSON.stringify(dataX));
            }
    });

Answer 1

The rest api calls always runs on logged in user permissions. So we can map user permissions with role definitions

1. Full Control - Has full control - User can make any call under end point "_api/web"
2. Edit - Can add, edit and delete lists; can view, add, update and delete list items and documents. - User Can do any operation on list and list items and end point would be "_api/web/Lists"
3. Read - Can view pages and list items and download documents. - User can do Get operations on list items and end point would be "_api/web/Lists/getByTitle('')/Items

Question 2:is Full Control the minimum permission level require to execute

Yes, it requires full control access.