If you are exposing your web-service to 3rd party application developers, I can think of two scenarios where a critical API may be called without user consent (given your UI guidelines):
- A bug in the code
- Malicious 3rd party developer, misusing the API
Against non-sindicated usage, what I can suggest is providing your 3rd party developers with API keys, which will be needed to issue the critical API call.
This way, you can shield your application from malicious use of the API, as well as track which 3rd party made which call, to be able to track down suspicious behavior.
As for bugs in the code, they are trickier, since there is no programatic way to prevent them. A possible solution might be to have a two-phase confirmation (i.e. sending a mail to the user, with a confirmation link, which he must click for the transaction to complete), or (maybe more user-friendly, but might not be possible, depending on the service) a mail with an undo transaction link, to prevent accidental transactions after the fact.