it is not enough. If the $instructor_id passed into the GET is some weird id which does not exist in the DB then you throw 404. Also remember that admin has an ability to retrieve instructor's info even though it is not necessarily that $instructor_id == $member_id where $member_id belongs to an admin