Hi Thirumal,
The syntax for catalogs is little bit different:
GET https://vcloud/api/org/<org-uuid>/catalog/<catalog-uuid>/controlAccess - Reading access control settings on the catalog.
POST https://vcloud/api/org/<org-uuid>/catalog/<catalog-uuid>/action/controlAccess - Updating access control settings on the catalog.
The difference is that the organization uuid should also be included in the URL.
Those URLs are available as links (with rel="down" and rel="controlAccess" respectively) in the response after GET-ting an organization (/api/org/<uuid>).
Regards,
Todor