Storing endpoint ARN vs. Device Token at backend
I would store the device token (and I do).  I was able to use it when I needed to transparently migrate a few million endpoints from a US region to one in Asia.  Might also come in handy if you also wanted to migrate off of AWS at some point. 
 The only reason I wouldn't store it is because of GDPR, but if you're not worried about that then it's not like it's a lot of data.
Also you only need to call create_platform_endpoint() once, storing the result ARN.  Watch out for a change to the device token.  If it does, you'll need to contact your server and notify it that it's changed and call create_platform_endpoint() again.  I've never actually seen this happen, however.
I am designing a backend service that sends to some mobile app user messages from my server. 
Having retrieved their device token using a webhook, should I store these tokens in DB and call create_platform_endpoint() every time I need to send a message? 
Or storing device token on backend is needless and excessive and once having obtained ARN from create_platform_endpoint(), there is no need to store mobile device tokens on backend?