The initiator should be added as a ‘starter’ to the process instance execution, it uses the user that was used to do the REST call. You can verify this in the database by checking the identity links associated with the process instance execution. Can you check what you’ve got there?