document_uri seems to be required and set to the appropriate scope in order to retrieve publisher groups of type restricted.

When posting to public:

'permissions': {
    'read': 'group:__world__', 
    'admin': ['acct:<user>@hypothes.is'], 
    'update': ['acct:<user>@hypothes.is'], 
    'delete': ['acct:<user>@hypothes.is']
}

To post annotations to a group with groupid so that annotations are visible to all in the group, use:

'permissions': {
    'read': ['group:<groupid>'], 
    'admin': ['acct:<use>}@hypothes.is'], 
    'update': ['acct:<user>@hypothes.is'], 
    'delete': ['acct:<user>@hypothes.is']
}