While modules generally shouldn't do this, there are a few cases where it's ok (e.g. ApiCSPReport) and a few where people do it even though they shouldn't (e.g. JsonConfig's API modules).

There's probably no need for the pretty-printed output (either directly or via ApiSandbox) to return with a non-200 status code, instead this should be indicated in the displayed text somehow.