Unless you are writing an external or public API, GraphQL and REST would be an extremely nasty choice. They limit you to low-level CRUD, creating more problems than they solve, and most importantly making it difficult to express your API in domain terms.
Look towards the RPC protocols, and see how elegantly they can describe your specific domain. And the choice is huge: Apache Thrift, gRPC, JSON-RPC, as well as my favorite, but for some reason little known in the Russian-speaking Internet E/A/?T (stands for entity/action/optional-target)