Entitlement required: manageUserGroups (Manage users and groups) or manageAllUserGroups (Synchronize users and groups) or manageUserStandardGroups (Manage users and standard groups) or updateAnyUser (Update any user).
Note: You only need one entitlement, but you can have more than one.
Federated users cannot be modified. The user's groups cannot be modified and are ignored in the payload. Group membership is managed by using the PUT /Groups API.