I am not talking about the app I am talking about the environment the app is running in. Of course there are crappy apps (I've made a bunch of them!) I remember IIS doing funky things with non-200 return codes. 5xx codes would have some default handler. I am certain this was an issue with configuration and a dysfunctional development process. In the shop I was in, in the mid 2000's, we the devs didn't have direct access to the web server and having the IT guys make any update took on the order of weeks. Instead of fixing the IIS config we just returned 2xx and handled the error in the app layer. We also had a couple SOAP(shudder) services that always returned code 200 with error codes in the response XML body. Much of our app code used this pattern for consistency. We also would deploy our services on various other web servers we didn't have full control over so it was just easier to use this pattern.