I'd agree with limiting the scope to the app under test. Though if your team also owns the backend service and there currently isn't a test for that endpoint, then I don't see the harm in verifying the response 🙂