I'm planning to make a very simple spread bot, now I see in the API documentation that bots can initiate withdrawals. For the sake of security, can the bots withdraw only to addresses in account's address book?
Edit: I see there are tiers with increasing privileges so that's really nice. Although my question still stands, is the api withdrawal fully automated or do they require email confirmation?