[Dashron]

Business logic should be hidden behind the API and the representation. Just like a website, actions are presented when the business logic allows it.

Other API calls depend on the purpose. If its part of the business logic, it's probably back end and hidden as described above.

If the other API call simply powers the UI, you might keep it in the client. One example is autocomple for facebook friends. The client can call facebook for a list, let the user select their friend, and then send that friends info to your API.

With that said, I'm not sure how either of those are "non-RESTful" so maybe I missed the point of the question?