One rule
Your status code should tell the client what happened before they read the JSON.
Use 2xx for success, 4xx when the client sent a bad request, and 5xx when the server failed.
Why it matters
Recruiters will run your API with curl, Postman, or Thunder Client. They should see useful status codes, not only pretty messages.
A frontend also depends on this. If your API returns 200 for an error, the frontend may treat a failed request as a success.