The API should have consistent and proper usage of HTTP error codes.
Right now wrong usage mostly results in an Internal Server Error (50x) and doesn't properly tell the user what went wrong. Furthermore, the API sometimes doesn't respond with an error code at all when obviously user input wasn't okay (see uploading files).
See https://httpstatuses.com for a list of responses.