Yes. APIs are one of the most common sources of serious vulnerabilities, so every connected endpoint receives the same scrutiny as the application itself, including tests for authentication gaps, excessive data exposure, and broken object-level authorisation.