How do I see which permissions are necessary to execute a given API call?
This doesn't have a completely straightforward answer because sometimes one entity will create another entity with its own set of permissions.  Additionally, permissions also get blended with ACLs and custom permission hooks.  Finally, the permissions typically happen at the BAO and not API layer.

That said - the best single resource is CRM_Core_Permission::getEntityActionPermissions(). See CRM-20581 for a real-life recent example of how creating an event failed because accessing the StateProvince entity went from being a permission-skipping call to a permission-respecting call.