This is a good post, but first a word of caution.

Many people, when faced with "unwanted information disclosure" via ID enumeration, will look to encryption to solve this problem. Please don't; it's the wrong tool for the job.

https://paragonie.com/blog/2015/09/comprehensive-guide-url-p...

Use a random lookup instead of encryption. (You'll notice that https://paragonie.com/b/oMFJhGJ0aSgCaZq0 takes you to the same URL.)

Use application logic (and access controls) instead of random lookups, where it makes sense to do so.

If you absolutely must use encryption (i.e. you don't have a place to store state), make sure you use an AEAD mode.

https://gist.github.com/tqbf/be58d2d39690c3b366ad