Thanks, Nathan and Martin. Your replies helped. I am not using PHP, I'm using C#/.NET, and Postman for testing. I think it's a deficiency of the documentation that it assumes that the API will be called from PHP.
By reading about how PHP is resolving the arrays to POST fields, I found the problem. The actual POST format of the fields is NOT actually (for example):
Field Name Value
secondaryGroups [7,8]
it's:
Field Name Value
secondaryGroups[0] 7
secondaryGroups[1] 8
This works.
I'd add that it's an annoyance that this sets and replaces any existing secondary groups. This requires reading existing ones and taking them into account, for adding new groups. Since this is an update operation, a more common use case would be to add new groups (or delete old ones). A suggestion, which would be backwards compatible, would be to add a new field, e.g. secondaryGroupsOp, with values 'replace', 'add', 'remove'. 'replace' would be current behavior, 'add' would add the group (doing nothing if the user were already in that group), 'remove' would remove the group.
Another approach occurs to me, also (I think) backwards compatible: if a '+' is prepended to the id, then add it to the existing groups; '-', remove it.