api returns code 200 instead of 400