Your statement about read_private_submission permission is correct, see
http://hud.rel.rest.doc.sagebase.org.s3-website-us-east-1.amazonaws.com/GET/evaluation/submission/query.html
Regarding READ permission, it needs to be documented (a task within PLFM-2591) and then you should be able to reference the answer in the aforementioned link.