You can't in general prevent clients from sabotaging themselves. In the extreme case, someone makes a separate page that's supposed to call your API, but just... doesn't work.
The point of the UUID system is to prevent the client from failing due to things that are outside its control; specifically, the actions of other clients.
The point of the UUID system is to prevent the client from failing due to things that are outside its control; specifically, the actions of other clients.