Your API Returns 200 OK for Every Error

There is an RFC for this. Your framework already supports it. You just never looked.