I can’t really speak to “right”
I noted above that I too am just starting with Camunda. However, if you really think about where you are doing your rate-limiting and how you’re pooling it, you have to have your worker make a REST call, otherwise your API Gateway has no way to know that it’s the same API (also, I can’t think of an API Gateway that supports interrupting Java functions)
Think of Camunda as a Project Manager.
The Project Manager doesn’t really do any of the technical work, they coordinate all the others who do. Camunda does the same thing… If a resource needs to be rate limited, the Camunda worker can make the request to the rate-limit service and wait for the response to come back. That is really the definition of orchestrate. Camunda can easily coordinate and sequence disparate API calls, where some might be REST and others might be gRPC. It allows you the ability to move your APIs from one platform to another, without having to completely recode all your microservices.
Camunda is extremely flexible. There’s a lot that you can make it do, but you have to take the time to plan out your process first considering all the constraints on the process from the beginning if you want to avoid refactoring.