It would be good to guard against sql injection here by explicitly casting these ids to integers since they're coming in from the UI. Same goes for `retrieve`.