We can argue about the semantics of "wrong" all day, but the lesson here is that not following standards and conventions creates extra work for everyone downstream.

They followed the standard though. They returned 200 for a resource that exists.

Many responses here seem to be based on the misunderstanding that this is about "not following a standard is sometimes okay-ish", when it's actually about the fact that the standard does not rigorously define what a "resource" is and what it means for the resource to "exist", other than a circular definition based on status codes.

Serving an identical resource at all possible paths is no one's idea of following established conventions. That's what redirects are for.

Is it an identical resource? How do you know? But let's say they are identical. Where in the HTTP spec does it say identical resources may not be served at different endpoints? Nowhere, of course.

You talk about violating conventions and standards. The conventions are defined by the HTTP spec. The standard is the HTTP spec. Neither are, so far as I can tell, being violated here.

> We might imagine that the set of resources should be finite, or strictly mapped to extant data records in our system – but these are not requirements.

Clearly they aren't requirements as I can think of many valid use cases that violate them.

To me, creating an infinite number of identical aliases for a single resource is clearly wrong. The only reason to do it is either incompetence or laziness.