200 is not success and 400 is not "no such endpoint" verifiedimportant
The API's codes describe the request, not the outcome: a DELETE that matched nothing still answers 200.
In detail
Three observed behaviours that a client has to be written around. A DELETE removes by matching the fields of the target, and a body that matches nothing returns 200 with an empty response — so the only way to know whether a pause was lifted is to read the list afterwards. A POST to a path that does not exist returns 400, not 404, because the body is validated before the route is resolved; probing for endpoints therefore needs GET, which does return 404. And GET on /v1/inject returns 405, which is how we know the path exists at all. The practical consequence for a control module: confirm every write by reading back, and never treat a 2xx as proof that the intended change happened.