1. A non-transitory machine readable medium of a server storing a program for processing application programming interface (API) requests received from mobile devices, the program executable by one or more processors of the server, the program comprising: a runtime instantiator for instantiating JavaScript (JS) objects, said instantiated JS objects configured to process the API requests, each JS object instantiated based on a JS model that comprises (i) a JS file storing a set of behavioral descriptions of the JS objects and (ii) a JS object notation (JSON) file storing a set of property descriptions of the JS objects, wherein the JSON file includes at least one validation rule to reject a data tuple unless the data tuple meets a required constraint specified in the validation rule; a data abstractor for serving as an interface between the JS objects and a set of data storages from which the JS objects retrieve data while processing a plurality of the API requests; and a data connector for connecting the data abstractor with the set of data storages by implementing a data exchange logic for the set of data storages, wherein the set of property descriptions of the JSON file, based on a JS object that is instantiated, comprises a description of a control logic for restricting access to one or more data tuples that are available to the JS object upon processing an API request, and wherein the control logic comprises at least one access control list (ACL) rule to ensure that a data tuple that is exchanged as part of the API request with the JS object satisfies a set of access control criteria.