Can I carry out penetration tests or stress tests on the APIs?

Yes. However, please note that if the live Production or Sandbox keys are used, all API calls would be counted against the available credits in your plan. To avoid using up your credits during early stages of development and testing, you could instead use a usage-limited trial version rather than the live keys.