Canister IDs could in theory change, but in practice I don’t see it happening. These IDs are hard-coded in so many places that I just don’t see how we could ever do that safely.
APIs are much less stable. In general, we try hard to not break APIs but sometimes there is no way around, e.g. due to security concerns.