You can read SSL traffic if you're able to install a root certificate on your device and the website/app doesn't use certificate pinning.

I recently used HttpToolkit to reverse engineer a REST endpoint that used SSL encryption

This isn't true. Mitmproxy and burp can both proxy TLS. Maybe you're misunderstanding the use case.

A good deal of APIs don't pin SSL certs so MITM works for a solid amount of them.

Only as long as you cannot load your own certificates, which you are able to in a lot of cases. Though on Android you can lock certificates allowed in a app, this can be circumvented though it adds another step. I am unsure if the same is a case for Apples devices, at least you might need jailbreak there.