It looks quite good. There are a few comments:
Where are you demonstrating that the user who is making the request is authenticated/authorized?
Any argument could be made that a PATCH request is not appropriate, but I wouldn't labour it.
This is a personal preference, I like to include the form within the request so it is clearer (for me) to see what the request is:
$response = $this->json('patch', '/api/admin/users/' . $user->id, [
'name' => 'New Test User',
'email' => '[email protected]',
'pin' => 90999999,
'password' => 'newpassword',
'password_confirmation' => 'newpassword'
]);
If I am performing an assertion that something is in the database as a result of the action, then I will often assert that it is not there before the action.
I don't like assertSee for a JSON response - I would use assertJson or assertExactJson - because you could change your implementation to return a view and that current test would continue to pass.