Interestingly enough, when creating an API key, there is a checkbox to (dis)allow withdrawal of funds using that key. So at some stage in the development, API-withdrawals were planned (and maybe they still are).
Yeah I just signed up and noticed this...but does not seem to be any mention of it in the API docs.