Hi Ben,
What if a user wants to grant a domain SP group unique read only permissions to subsite?
Would the uri look like this: _api/web/roleassignments/addroleassignment(principalid=<groupid>,roledefid=1073741827)?