user, uid 2)This is a normal SaaS account portal. Everything in the nav is scoped to YOU. The interesting objects (other users' orders, invoices, notes, and an admin console) are not linked here on purpose. This module is about reaching them anyway: change ids, swap verbs, forge headers, and trust nothing the client sends.
Tip: the JSON API under /m02/api/... is where most of the object references live. Read one of yours, then try someone else's.