Required permissions/role for creating groups

I am currently trying to create groups via the JavaScript admin client, which uses the admin API. I am getting a 403 error, so I am sure my service-account is missing a group.
I’ve been searching for a Keycloak admin-API-reference with permission annotations for hours, but could not find one.

Does anyone here know the necessary role and maybe know a good reference?