TIL: Never Trust a 200 OK Response Alone

I spent an entire afternoon debugging a third-party payment integration where every request returned a 200 OK status, yet no payments were actually being processed. I assumed that since the HTTP layer was happy, the business logic had succeeded, which led me down a rabbit hole checking my own database triggers and webhook listeners.

It turned out the API provider uses a 200 OK response for almost everything, including business logic errors. Instead of using 400 or 500 status codes, they placed the actual failure details inside the JSON response body under an error field. Once I started logging the full response body instead of just the status code, the culprit was immediately obvious.

The lesson here is simple: an HTTP status code only tells you if the request reached the server, not if the action was successful. Always validate the response body for error objects or status flags before marking an integration as "working."