If this is still relevant...
Which version of vRA are you using?
If you look at the REST call, it is making a call to vRA ( https:// {{vraHost}}/cmx/api/resources/vsphere/endpoints/{{vsphereEndpointSelfLinkId}}/ storage-classes ) , not to vSphere. So I don't think the permissions is at the vSphere level, it seems to be permissions to vRA itself?