- This is Microsoft.
- He returns Webhook success with a code 200 and plaintext 1.
- He returns Webhook failure with a code 200 and a string tells its endpoint returned error 400.
- the string didn't tell what exactly the error.
- Don’t be like Microsoft.
EDIT: Got a few details wrong since this happens a few months ago and this meme used to be on r/ProgrammerHumor. Also the proof: 
It's hard when you hit an endpoint that hits another endpoint, because technically the first request IS a 200. No right or wrong way as long as they are consistent and document it clearly imo
X-Forwarded?
Can / should you use it for anything other than IPs?
Well, if its acting as a proxy, then the status code should be transmitted intact right?
It's not really a proxy, it's just making another request as part of its request