Your primary key shouldn't be in the URL

Sequential IDs in URLs leak order volume and invite enumeration. Public UUIDs distinct from primary keys, and why that is defence in depth rather than access control.