My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL certificates warn about how users of the a website won't trust you if you self-sign and they don't know you. But in this case, I don't need my users to trust me, but rather the app has to trust me. Are there any problems with this approach or should I just fork out the money to one of the CAs so I don't have to worry about it?
For your particular use case, a self signed cert would be fine.
As you control the app, you do not have to use certificates recognized by browsers, which is the key point of a certificated by a trusted CA.
Functionally, there is no difference in security. See: Does Self-signed certificate differ from CA from a security point of view?
Security of the system is dependent on client implementation. All a certificate inherently does is provide an "agreed encrypted communication protocol". How secure the communication is in actuality is whether or not there is someone playing "man in the middle".
So how do you verify that the certificate received is the same certificate that the source wants you to use? That's either through a 3rd party verifier (which is what comes with payment to a CA) or through the client who (from a previously hard coded implementation) already whats what the cert should look like.
Using self-singed certificates is generally a bad idea. Consider the scenario: you hardcode your certificate fingerprint to make sure there's no MITM. Imagine that your server gets compromised, and you need to revoke the certificate, and issue a new one.
Think of the consequences to your user base - having to update a new version of the app.
Is it possible? It is, although your mileage may vary, as they say. You work out of the risk profile of the data you're transferring, and the nature of the transactions. For example, if you've got a game and transfer your game high scores only, then it should be OK. However, if you start transacting other things, like user registration, then it wouldn't be that good.