There is nothing wrong with the patch statement. It's simply that my JSON was incorrect. All thanks to @DaveSyer for making my narrow sight (focusing on the method, Patch red.) expand.
Firebase have written:
Error Conditions
The Firebase REST API will return error codes under these circumstances.
A request made over HTTP instead of HTTPS will result in an HTTP status code404 Not Found
Unable to parse PUT or POST data will result in an HTTP status code 400 Bad Request
Missing PUT or POST data will result in an HTTP status code 400 Bad Request
Attempting to PUT or POST data which is too large results in an HTTP status code 400 Bad Request
A REST API call that doesn't specify a namespace will result in an HTTP status code 417 Expectation Failed
A REST API call that contains invalid child names as part of the path400 Bad Request
A request that violates Security Rules will result in an HTTP status code 403 Forbidden