You want to know what permissions are required to a(n) on/to .
action
The action that the user wants to perform (e.g. upload, post, delete, share etc.)
object
The object that the user wants to send to the API (e.g. a photo, status update, link)
target
The target of the action (e.g. a page, group, user etc.)
subtarget
While the target represents a group or a page for example, it is not explicit about where the action will be performed exactly (for example timeline, photo album)