Should the API return code always be 200?
HTTP return codes are typically indicative of "plumbing" issues between the client through the web server. A malformed API call is more indicative of an underlying data issue so doesn't really fit the same scheme (IMHO).

Further, I think that error handling for plumbing issues (ala "Website not available") probably needs to be different than that for API errors. I know my coding would always handle things differently.

That said, this question really calls for no more than personal opinions so should probably be closed.