API should be using the http status code for success instead of an explicit "success" flag in the response JSON body.
If the request fails due to authentication error, the response should be 4xx. If there's a server error 5xx. And success should be 2xx or 3xx.
This way, the response body can contain just the 'data'. If there's an error, the body can contain just the 'error' + relevant status.