sharepoint online – What scope/permissions do I need to get RoleAssignments via the rest api?

As far as I know, only full control permissions can get role assignments with rest api.

So you have to give Full Control Scope to your app.

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="FullControl"/>
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl"/>
</AppPermissionRequests>