Question: I have developed two web services. The main service is a RESTful service (using DB), and another UI service that uses the RESTful service.

Say I want to test the UI for now (integration tests), every test will makes changes in the prod DB. More then that, if in the RESTful service, there are one-way functions for security reasons. I mean that functions that can not be revert (Say if mark item as 'done', I can't edit or delete it anymore)?

This things are very logical, the most websites I know have the same situation. All these websites are not testable?

Answer: 
First of all, you shouldn't be testing against your production database. If you ever need to rerun your tests after the application has gone live (and you *will* need to do that), you run a serious risk of losing or corrupting data that is vital to the business.

So, instead of testing against the production database, you test against a test database (which should structurally be a copy of the production one). Then you can also add facilities to your test harness to reset that test database to a known state just before or after running a particular test.  

This way, you can test the correct (inter-)operation of the two web services.

If the correct operation of the RESTful service can be presumed, you can also opt for a fake/mock of the RESTful service, which gives all the expected responses for the particular test, but doesn't actually persist anything.
Since you have to do unit testing for the REST API, I would assume you are using mock objects for those, rather than interact directly with the database. This should give you a framework of proper "valid" responses from the API already - what I'm getting at is that when you test, you should know you're in "test mode" (either through some global environment variable, separate testing environment or an extra parameter you set in the requests r somewhere else in your workflows). So if you are in test mode, your REST API should return mock objects to your client in the response, without affecting your database records in any way.

Since these are tests on the client side, your concern should be strictly to test the client interaction, because proper API behavior is tested by the REST server-side unit tests, so you should assume that the API itself behaves as it's supposed to.