I like to find a middle ground.

I use http status codes to encode how the _request_ was handled, not necessarily the data within the request.

A 400 if you send mangled JSON, but a 200 if the request was valid but does not pass business validation rules.

Inside the 200 response is structured JSON that also has a status that is relevant at the application level.

Otherwise how can for example you tell if a 404 response is because the endpoint doesn't exist, or because the item requested at the endpoint doesn't exist?

I believe it's important to have a separation between what is happening at the API level vs Application, and this approach caters for both.