To put the question into some context, the system exposing the web service uses GUIDs internally as identifiers for all entities.
In such case, when designing a public facing data integration web service (used mainly for importing or exporting data from the system to other, external systems), what would you consider as pros and cons of using the internal identifiers in the interface of the service?
With such solution, the export methods of the web service would return the dto’s identified with GUIDs and the import methods would accept similar dto’s – I assume the external system would be responsible for generating new GUIDs for new entities.
What are the potential issues one might face with this approach?
The technology stack for the system and web service is .NET / WCF / SOAP
First, let’s look at the more generic “how do I set up a public API” question, my first exercise is determining what information is needed by the consumer of the service. I also look and see if there are is company specific naming in the object model. I then create a service model (data contract, if you want WCF specific) that matches the view I want to show the consumer. This includes a unique key, which is more often a SKU string (human readable key) than a GUID/int (the actual derived primary key), as the SKU is public and the means of storing in the database is not. So, in general, I would not expose these primary key concepts, if that is what the GUID is.
Now to the question of “do you see problems with this approach”. I will focus on more general concepts so you can make a more informed decision, as there is no 100% right/wrong answer.
As long as this is machine to machine and the use of the GUID is something both systems are aware of, I see nothing particularly scary about this approach. If this ultimate goes to a human readable system where the GUID has to be interacted with, then you have an issue.
One potential issue with the system is exposing your own primary key information to customer or client systems, who don’t have to understand this level of detail. If this is actually “semi-public” with a select list of vendors, the “risk” might be less. This is the primary issue I see.
One could argue the weight of the GUID (128 bits) versus a smaller identifier, but this is a bogus answer, IMO, as the network latency more than outweighs sending a few more bytes as a request parameter.