Simple, form-bound mutations tied directly to a single page's UI — submitting a form, toggling a setting — get real benefit from Server Actions' reduced boilerplate and automatic revalidation, with no separate API route to maintain.
Anything that needs to be called from outside the Next.js app itself (a mobile client, a webhook, a third-party integration) can't use a Server Action — it needs a real API route regardless, which means duplicating logic if you built the internal flow as a Server Action first.
If this logic will only ever be called from this app's own UI, Server Action. If there's any chance an external caller needs it — even a future one — build it as an API route from the start and call that route from the UI, so there's one source of truth instead of two.