I've found that many APIs sloppily use parts of webdav and create a fairly ugly hybrid approach. I think the HTTP codes should be used simply to reflect the tr

I've found that many APIs sloppily use parts of webdav and create a fairly ugly hybrid approach. I think the HTTP codes should be used simply to reflect the transport (in this case HTTP) and any application level stuff should be returned in a systematic way inside the response body. Which means any API call to a valid resource that the user has access to should return a 200. Then clients can safely assume that if they get a 4xx or 5xx something is breaking, and if it's a 200 then look at the body and deal with the actual response.