You store a user ID but in your api definition you rely on api_dev_key. These keys shouldn’t be predictable so if they are your user ids (primary keys), they would be easily predictable. do clarify this.