Thank you for the solution Amit. I have been trying to update the permissions for my workflows since 1 day. I came across your post, changed the structure of the payload and it worked fine. So basically when you do a get request to fetch the ACLs, you get :
'access_control_list': [{'user_name': 'xyz@abc.org', 'display_name': 'Xyz, Fgv', 'all_permissions': [{'permission_level': 'IS_OWNER', 'inherited': False}]}]
But while updating, you need to discard the 'all_permissions' list and add everything inside in the dict. I wonder why it works this way when while fetching the ACLs we get it with the 'all_permissions'.
Also I have seen if there are any inherited ACL, we do not have to mention that in the payload. It take the permission for that group (eg. admin) automatically.
Regards,
Andolina