One dev at the company I work is developing an API and the response for all the requests are basically the same.

However, for example, if you request a login and your credentials are wrong the response gives you:

{
'foo':[],
'var':[],
'msg':'credentials error'
}

But if the credentials are correct, the response gives you:

{
'foo':[
'stuff1':1,
'stuff2':2,
'stuff3':3
],
'var':[
'var1':1,
'var2':2,
'var3':3
],
'msg':'logged in!'
}

Is that correct? I mean, does that compromises security?