fix: api routes should be able to return non-200 status#1228