Thank to the help of the customer support, I can now share how to do this:
You first have to run a GET request to get all currently assigned fields / parameters:
https://<domain>.my.workfront.com/attask/api/v15.0/ctgy/<categoryID>?fields=categoryParameters:*
In the next step, you have to run a PUT call containing the previous parameters and the new one(s):
PUT HTTP REQUEST URL:
https://<domain>.my.workfront.com/attask/api/v15.0/ctgy/<categoryID>
JSON BODY:
{
"categoryParameters": [
{
"objCode": "CTGYPA",
"categoryID": "<categoryID>",
"customerID": "<customerID>",
"displayOrder": 1,
"hideFormulaFromDescription": false,
"isInvalidExpression": false,
"isRequired": false,
"parameterGroupID": "<parameterGroupID>",
"parameterID": "<parameterID>",
"rowShared": false,
"securityLevel": "LE",
"viewSecurityLevel": "V"
},
{
"objCode": "CTGYPA",
"categoryID": "<categoryID>",
"customerID": "<customerID>",
"displayOrder": 2,
"hideFormulaFromDescription": false,
"isInvalidExpression": false,
"isRequired": false,
"parameterGroupID": "<parameterGroupID>",
"parameterID": "<parameterID>",
"rowShared": false,
"securityLevel": "LE",
"viewSecurityLevel": "V"
},
{ "objCode": "CTGYPA", "categoryID": "<categoryID>", "customerID": "<customerID>", "displayOrder": 3, "hideFormulaFromDescription": false, "isInvalidExpression": false, "isRequired": false, "parameterGroupID": "<parameterGroupID>", "parameterID": "<parameterID>", "rowShared": false, "securityLevel": "LE", "viewSecurityLevel": "V" }
]
}