Actual unpopular opinion¹: I don't care if a server returns 200 OK with an error in JSON, as long as the JSON has a separate status field that has different values on success/failure. People put HTTP on too big a pedestal tbh. Just treat it like an RPC layer and get on with it. ¹ people have told me so