Have an internal ID and one "public" ID. The public one can be mutated with PUT/PATCH calls that are idempotent, the internal ID never ever changes.
real world systems might have to change actual ids. like the article. or say you grow to some other use case not covered before because of new regulation etc... 301 is the only rest way.