I've been abusing HTTP Status Codes in my APIs for years
If you’re a public API, please don’t do this.<p>I’ve personally integrated with almost 50 different SaaS APIs in the last 2 years.<p>The worst ones to work with were the ones returning errors in 200.<p>I don’t want to parse and write switch statements for your strings to understand whether it’s authentication, authorization, not found or any other error.<p>Now I have logic tied to strings you return and I can’t wait until someone decides to change the error messages they return. People rarely assume there’s an API contract in error messages.