Two Hundred And Sad

An API returns HTTP 200 for every request and signals failure with a body like {"ok": false, "message": "invalid email"}. Integrators keep reporting that their retry and alerting logic never notices failures. What is the fix?

Keep the 200 status and standardize the human-readable message string so clients can match on it

Return a 4xx or 5xx status plus a stable machine-readable error code in the body

Keep the 200 status and add an X-Error header so proxies and client middleware can branch on it

Return 500 for every failure so that generic client retry logic engages on all of them