You click "My Orders" on a website. The server looks up your session, finds your account, pulls your orders, and builds an HTML page just for you. The server decides what you see. You never see an ID. You never touch the query.
Your phone app wants your orders. It sends a request: GET /api/orders/1042. The server receives that ID — 1042 — and fetches whatever order has that number. The client is telling the server exactly what to fetch.
When we moved from server-rendered web pages to APIs, we handed control of what gets requested to the client. The client now sends the ID. If the server just fetches whatever ID it receives — without checking if you own it — anyone can request anything.