After a bit of digging, I found some information courtesy of the TI engineers over at their e2e forums.
The LMX2820 is programmed using 24-bit shift registers. The shift register consists of a R/W bit (MSB), followed by a 7-bit address field and a 16-bit data field. Addresses can be found in the address map. For the R/W bit, 0 is for write, and 1 is for read.
To read a register, serial data is shifted MSB first into the shift register. The R/W bit must be set to 1, followed by the 7-bit address. The data field contents on the SDI line are ignored during a read operation; and the read back data on MUXOUT pin is clocked out starting from the falling edge of the 8th clock cycle.
In a write operation, the first bit is a zero, followed by the seven-bit address, followed by the 16-bit register contents to write. Data is buffered during the shift-in, and is written to the internal register only after the 24th bit is clocked. Data is shifted in on the SCK rising edge.
For example, to read the current state of the reference path multiplier (address 0x0C) you would clock in, in MSB order:
1000 1100 XXXX XXXX XXXX XXXX
(X meaning 'don't care', and the first bit set to '1' for read mode)
and after the 8th clock, you would start to receive on MUXOUT:
0000 0100 0000 1000
(i.e. the power-on default of 0x408 per the register map.)
If needed, further details about the power-on sequence can also be found at the link.