in the database I have a record such as this:

    id: 53,  
    part_number: 'MOTOR-OIL',
    description: 'Motor Oil'

I wish to use a link that displays this record. I could refer to the record like so, using the surrogate key:


or I could use an domain-specific identifier like so, provided it's unique:


Is there a best practice of a framework relating to deciding which one to use? Is it acceptable to use the surrogate key?


In my case, the surrogate/artificial key is a PRIMARY KEY and quite unlikely to change. The part number however might change, while retaining the same surrogate key.

In my case the domain entity's part_number is unique, but in the general case, it may not be the case, and more parameters may be required to uniquely identify a record, while id being a surrogate key will typically remain unique per various database conventions.

  • Should a surrogate key ever be exposed to a user?
    – gnat
    Commented Dec 14, 2017 at 20:04
  • 1
    Did you read the article @gnat linked? Commented Dec 14, 2017 at 20:44
  • 1
    See also Exposing database IDs - security risk? Commented Dec 14, 2017 at 20:49
  • 1
    Yep, if you read several of the comments I posted below his answer, you noticed that I agree with you. Surrogate keys will never change. Ever. Commented Dec 14, 2017 at 20:50
  • 2
    You're misusing the term "SRP." SRP doesn't mean "information should only reside in one place," it means "a class should have only one reason for modification." It is a guideline for making classes easier to maintain, not a method of data decoupling. Commented Dec 14, 2017 at 22:17

2 Answers 2


It is ok, when

  • you do not bother that someone might use that surrogate value to deduce the number of records in the related table

  • you do not bother that someone might guess other valid URLs from that number

These are minor issues, and if required, one can easily overcome them by using something like a GUID or some salted hashed value as surrogate key.


Doc Brown's answer covers security issues. Another angle is if this is facing the public.


is more likely to fare better in SEO than


If the world isn't seeing it, it doesn't matter (if they get into your network this is not the biggest attack vector), if you want search engines to find it then ids (guid or integer) are not that good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.