> you should not assume the format of a non-200 status code
You should never assume format based on status code at all! You should detect it based on the Content-Type header.
> You'll get a 500 with a plaintext body. Don't parse that as JSON.
Any intermediary which returns plain text with an application/json Content-Type is badly, badly broken.