You deal with it the same way as you deal with any value that may change and may not be unique: you don't make it your primary key. Just index it separately, a

You deal with it the same way as you deal with any value that may change and may not be unique: you don't make it your primary key. Just index it separately, and resolve your links at insertion time to your internal actually-stable-and-unique keys. Then when your system runs into one of these duplicates you can tell what is happening, and you have a chance to fix it, rather than blindly plowing ahead and ruining even more data. None of this has anything to do with how you represent your API to other systems. Do whatever you need there. And if system X is confused and thinks public-ID-Y is actually Z, well now you can handle it - that's just another discriminator, but you select this one based on the querier.