Yes. A UUID consists of only hexadecimal characters (a–f, 0–9) plus a hyphen (-). As per RFC 3986 (URI Syntax) §2.3, hyphen and hexadecimal characters are included in those explicitly unreserved: Characters that are allowed in a URI but do not have a reserved purpose are called unreserved.

What is UUID URL?

A UUID (Universally Unique IDentifier) or GUID (Globally Unique IDentifier) is a data type that can replace the frequently used integer data type for the ID column in a database table. A UUID has to adhere to the format set by the RFC 4122 specification.

Is it safe to expose a UUID?

"Never expose your database IDs to the client." ... If the problem is that someone can see how many rows we have in a table, because that "id" is auto incrementing, I would just make the "id" an uuid, and expose that to the client.