I see the problem. It is because you are inputting parameters that are not valid ones. The REST API Patch call should look something like the example in the page:

You are inputting values that are shown on the sample response.

Please validate the input parameters indicated on the API.

{
"access_control_list": [
{
"user_name": "string",
"group_name": "string",
"service_principal_name": "string",
"permission_level": "CAN_MANAGE"
}
]
}