use http error codes
Currently the API responds with code 200 regardless of the outcome. For debugging and logging it's handy if a 400 error is reported as such so I suggest to change current behavior to only report 200 when the query was successful.