GetCertificateGroups returns the list of certificate groups for an application.

From the spec:
"GetCertificateGroups returns the Certificate Groups assigned to Application"

My assumption was always, that the "assignment" of Applications to GDS CertificateGroups happens with StartSigningRequest.

But the description of GetCertificateGroups states:
"The values returned by this Method are passed to the GetTrustList (see 7.6.9), StartSigningRequest (see 7.6.3) or StartNewKeyPairRequest (see 7.6.4) Methods."

This is wrong and misleading from my point of view. This would require that the assignment happens through some magic, custom configuration and the assignment is always already there before StartSigningRequest is called and the assignment can not be done by the calling application.

The description should state:
"The values returned by this Method are passed to the GetTrustList (see 7.6.9) or GetCertificateStatus (see 7.6.8) Methods.
The assignment to CertificateGroups available in the GDS happens with StartSigningRequest (see 7.6.3) or StartNewKeyPairRequest (see 7.6.4) Methods.
The list of CertificateGroups managed by the GDS is provided below the CertificateGroups folder."