Hey,
Please refer the below blog :
The scenario depends on the API type, whether the API is a synchronous or an asynchronous API.
In case if it is an asycn API, the web activity status becomes success irrespective whether the output was received or not (As the scenario in above blog)
So you have to use a fail activity depending on the scenario of IF ELSE aspect.
In case if the API on which you are trying to hit, has 40* error, like unauthorized; then the web activity would fail