In an HTTP endpoint, the HTTP Response node does not return the configured status code when the response body type is set to JSON. Instead, it always returns HTTP 200 OK. When the response body type is configured using an Expression, the configured status code is returned as expected.
For comparison, I also created a second endpoint where the HTTP Response node is configured to return 403 Forbidden and the response body type is configured using Expression. When this endpoint is called, it correctly returns the configured 403 status code.
To verify this behavior, please click the Test 2 button below.