you will have to keep security in mind - you do not want to open up a way for any invoice to be retrieved just knowing the customer id and invoice id