The API entry point is /access/acl. For example:
# pvesh set /access/acl --path /vms/200 --user joe@pve --role PVEAuditor
To see current ACLs use
# pvesh get /access/acl
To delete above ACL use
# pvesh set /access/acl --path /vms/200 --user joe@pve --role PVEAuditor --delete