title: API design and security: Why hide internal ids?
body: <p>I've heard a few people say that you should never expose your internal ids to the outside world (for instance an auto_increment'ng primary key).  </p>
  
  <p>Some suggest having some sort of uuid column that you use instead for lookups.</p>
  
  <p>I'm wondering really why this would be suggested and if it's truly important.  </p>
  
  <p>Using a uuid instead is basically just obfuscating the id.  What's the point?  The only thing I can think of is that auto_incrementing integers obviously point out the ordering of my db objects.  Does it matter if an outside user knows that one thing was created before/after another?</p>
  
  <p>Or is it purely that obfuscating the ids would prevent "guessing" at different operations on specific objects?</p>
  
  <p>Is this even an issue I should thinking about when designing an external facing API?</p>