The logic has to run server side either way.. but that's obvious. Otherwise any idiot with an API key has full control over your system. That's why you don't "m

The logic has to run server side either way.. but that's obvious. Otherwise any idiot with an API key has full control over your system. That's why you don't "make a pure REST API which provides low-level CRUD operations" as you've suggested. If you have invariants which must be held then you can't do that - and with any meaningful system you will have such invariants. Frontend? You can implement it in a shared library and cross compile. Or implement it in a DSL and interpret (or compile) that for each target platform. Is that overkill? Then implement the bits (it's almost always a subset) you need in the frontend. Don't like that but your app can assume an internet connection? Then keep a connection open (i.e. Signal R) and call procedures on the server.