Why should a REST controller return `ResponseEntity<T>` instead of just `T`?

Returning the bare object always yields HTTP 200 with the object serialized as the body, giving you no control over status code or headers. `ResponseEntity<T>` lets the same method return 201 Created with a `Location` header after a POST, or 404 with an empty body when a lookup misses — the status code becomes an explicit part of the API contract instead of an accident of always-200.