What API permission do I need in order to assign role to a user

I'm doing a (@POST) request the role assignment endpoint

https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments

with this payload:

{
    "@odata.type": "#microsoft.graph.unifiedRoleAssignment",
    "roleDefinitionId": "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxx",
    "principalId": "aaaaa-cccc-bbbb-bddd-eeeeee",
    "directoryScopeId": "/"
}

and I'm getting this error message:

{
    "error": {
        "code": "Authorization_RequestDenied",
        "message": "Insufficient privileges to complete the operation.",
        "innerError": {
            "date": "2024-12-19T08:49:21",
            "request-id": "aaaaaa-aaaa-aa-aaa-aaaaaa",
            "client-request-id": "aaaaaa-aaaaa-aaaaaaa-aaaa-aaaaaaaaaa"
        }
    }
}