I Can't Know Who Has Access To A Report Via APIs

You haven't missed an API, this is a genuine gap. The Apps admin APIs let you enumerate an app's audiences and their members, but they don't expose the audience-to-content mapping, so there's no supported call that tells you "audience A1 can see R1." That's exactly the piece you'd need to reconstruct per-report access, and it isn't surfaced today. The scanner (metadata) API doesn't fill it either.

So the airtight per-report answer isn't available purely from APIs right now. A couple of ways people work around it:

The audience-to-report mapping itself is static and low-volume, and you can read it from the app's configuration in the UI. If you capture that mapping once (A1 → R1, A2 → R2) and keep it current, you can join it to the audience membership the APIs do return, and that reconstructs who can see R1 vs R2. Not fully automated, but reliable as long as the app structure doesn't churn constantly.

If you need it to be fully API-driven and auditable, the cleaner structural fix is one audience per app, or separate apps per access boundary. Then access sits at the app/workspace level, which the APIs report on properly, and you lose the blind spot entirely.

Longer term it's worth logging on the Fabric Ideas site, since audience-level content visibility in the admin API is a real reporting gap for exactly the governance use case you're describing.