It depends on the datastore, but generally it's a timestamp. And yes, the general rule of thumb with Watch API is to keep track of the last processed zedtoken and make your service idempotent, in the case where the changes for a zedtoken have been processed by your application but the zedtoken hasn't been recorded (e.g. involves a dual-write to two different systems of record)