Short answer: It doesn't matter
In some cases using /api/1234 could be a disadvantage. If the application lacks proper authorization checks, a user could try /api/1235 and access another user's account. This kind of vulnerability is surprisingly common in practice. /api/me is good because it forces the developer to fetch the ID from the session.
/api/1234 can be an advantage if the user ID is a secret. This depends on the application - usually with interactive applications, users can see other users' IDs. If the ID truly is secret, this protects against CSRF. However, you application should already have CSRF protection, usually through a token in a hidden field.
In general, if someone gets hold of an access token, all bets are off. Focus your security effort on stopping anyone getting hold of a token.