Some of the comments here are positing a false dichotomy. The choices aren't between returning 200 with an error code and returning an HTTP code for each error.

Some of the comments here are positing a false dichotomy. The choices aren't between returning 200 with an error code and returning an HTTP code for each error. I've gone down the path of trying to shoe horn every error condition into a separate HTTP status code and (IMHO) it's a Big Mistake [tm]. You really are confusing transport and application layers and the transport layer simply doesn't have enough codes for what you need. When something obviously fits into an HTTP status code then sure, use it, particularly when it'll mostly make your client do something sensible. But you just can't get away from needing error codes that go beyond HTTP status codes for any moderately complex Web application.