[pointe]

You should not expose any internal identifier (numeric or otherwise) because it then becomes public & part of your API (even if undocumented).

[ilikehurdles]

In one case the api I worked on used encrypted IDs on the way out to the client, and decrypted them on the way back to the db. Even when multiple clients referred to the same resource, they would see different public IDs, but any instance of the API could reach the underlying value from those public values.