A single item in the audit log represents both the beginning and end of the logged operation (represented by time_started and time_completed) so that clients do not have to find multiple entries and match them up by request ID to get the full picture of an operation. Because timestamps may not be unique, entries have also have a unique id that can be used to deduplicate items fetched from overlapping time intervals.

Audit log entries are designed to be immutable: once you see an entry, fetching it again will never get you a different result. The list is ordered by time_completed, not time_started. If you fetch the audit log for a time range that is fully in the past, the resulting list is guaranteed to be complete, i.e., fetching the same timespan again later will always produce the same set of entries.