...

• Use your RAO to create the new admin as you would create a "normal web UI admin", including setting a temporary password. You will not be able to use the API with this temporary password.
• Login to the new admin in the SCM and perform the mandatory initial password change for it.
• Back with your original RAO, edit the new admin and set the "WS API use only" flag for it.

More gotchas we have discovered, so you do not have to discover them too:

• To be allowed to use the API calls for handling certificates, you must edit the appropriate Organization or Department object, and on the SSL Certificate tab, enable the Web API checkbox. You will be required to provide a value for the Secret Key field too. Enter a good random value there and promptly forget it. As far as we are aware, that secret is not used for the current REST API.

ACME support

There is support for ACME and some of the test members have started to try that. We will update this section as we get feedback.

...