...

• Just as a tool to sort certificates and get the correct OU= set, but it will still be the Organization's admins doing the approval.
• To delegate approval of certificates to department admins for their department. In most(?) cases that would be combined with registering a subdomain (or a completely difffent domaindifferent domain) and restrict the department to that.

...

• To be allowed to use the API calls for handling certificates, you must edit the appropriate Organization or Department object, and on the SSL Certificate tab, enable the Web API checkbox. You will be required to provide a value for the Secret Key field too. Enter a good random value there and promptly forget it. As far as we are aware, that secret it (it is not used for the current REST API but for an older SOAP API).

ACME support

There is support for ACME and some of the test members have started to try that. We will update this section as we get feedback.

...