API consumers must not be tempted to parse ids, so we encode them as
UUIDs to prevent that.