You can test the security of your API by manually penetration testing. However, you can save a lot of time and money if you first use an automated vulnerability scanner. This way, your penetration testers will have much less work and can focus on the most challenging issues.
Read how vulnerability scanning and penetration testing work together.