APIs must be tested from an adversarial standpoint that mimics how they would be exploited by a malicious user. An API penetration test is one of the best ways to discover common vulnerabilities and business logic flaws.
A good API penetration test will test for common vulnerabilities, business logic flaws, validate findings, and demonstrate what an attacker would accomplish with the given weaknesses.
The most valuable part of a penetration test is getting a comprehensive report that describes the findings, associated risks, and remediation recommendations.