docs: update CLI and helm reference for v2.51.0

client_reference/kosli_create_api-key.md

@@ -1,6 +1,6 @@
 ---
 title: "kosli create api-key"
-description: "Create an API key for a service account."
+description: "Create an API key for a service account, or a personal API key for yourself."
 ---
 
 ## Synopsis
@@ -9,13 +9,16 @@ description: "Create an API key for a service account."
 kosli create api-key [flags]
 ```
 
-Create an API key for a service account.
+Create an API key for a service account, or a personal API key for yourself.
 
 The key value is only returned once, at creation time, so make sure to store it securely.
 
 Every API key expires. Without `--expires-at` the key is given the maximum allowed
 lifetime, and an `--expires-at` beyond that maximum is capped to it.
 
+With `--personal`, a key created using another API key is revoked along with that key,
+and expires no later than it.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
@@ -24,7 +27,8 @@ lifetime, and an `--expires-at` beyond that maximum is capped to it.
 | `-e`, `--expires-at` | string | [optional] When the API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Keys always expire: when not set, the key gets the maximum allowed lifetime, which also caps later dates. |
 | `-h`, `--help` | bool | help for api-key |
 | `-o`, `--output` | string | [defaulted] The format of the output. Valid formats are: [table, json]. (default "table") |
-| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. |
+| `--personal` | bool | Manage your own personal API keys instead of a service account's. `--org` is not needed. Either this or `--service-account` is required. |
+| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. Either this or `--personal` is required. |
 
 
 ## Flags inherited from parent commands
@@ -59,6 +63,14 @@ kosli create api-key
 	--service-account yourServiceAccountName 
 	--description "key for CI" 
 	--expires-at 2026-12-31 
+
+```
+</Accordion>
+<Accordion title="create a personal API key for yourself">
+```shell
+kosli create api-key 
+	--personal 
+	--description "key for CI" 
 ```
 </Accordion>
 </AccordionGroup>

client_reference/kosli_delete_api-key.md

@@ -1,6 +1,6 @@
 ---
 title: "kosli delete api-key"
-description: "Delete one or more API keys for a service account."
+description: "Delete one or more API keys for a service account, or your own personal API keys."
 ---
 
 ## Synopsis
@@ -9,7 +9,7 @@ description: "Delete one or more API keys for a service account."
 kosli delete api-key KEY-ID [KEY-ID...] [flags]
 ```
 
-Delete one or more API keys for a service account.
+Delete one or more API keys for a service account, or your own personal API keys.
 
 This permanently deletes the API key(s) identified by KEY-ID. Deletion is immediate and
 cannot be undone. You are asked to confirm before the key is deleted; use
@@ -18,13 +18,17 @@ cannot be undone. You are asked to confirm before the key is deleted; use
 When stdin is not interactive (e.g. in CI) the prompt cannot be answered and the
 command fails without deleting anything, so pass `--assume-yes` there.
 
+Deleting a key also deletes every key that was created with it. With `--personal` and an
+API key as `--api-token`, you can delete only that key and keys created with it.
+
 ## Flags
 | Flag | Type | Description |
 | :--- | :--- | :--- |
 | `-y`, `--assume-yes` | bool | [optional] Skip the confirmation prompt and delete the API key without asking. (alias: `--yes`) |
 | `-D`, `--dry-run` | bool | [optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
 | `-h`, `--help` | bool | help for api-key |
-| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. |
+| `--personal` | bool | Manage your own personal API keys instead of a service account's. `--org` is not needed. Either this or `--service-account` is required. |
+| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. Either this or `--personal` is required. |
 
 
 ## Flags inherited from parent commands
@@ -64,6 +68,13 @@ kosli delete api-key keyID1 keyID2
 kosli delete api-key yourApiKeyID 
 	--service-account yourServiceAccountName 
 	--assume-yes 
+
+```
+</Accordion>
+<Accordion title="delete one of your own personal API keys">
+```shell
+kosli delete api-key yourApiKeyID 
+	--personal 
 ```
 </Accordion>
 </AccordionGroup>

client_reference/kosli_diff_snapshots.md

@@ -66,7 +66,7 @@ kosli diff snapshots aws-beta aws-prod --output=json
 ```json
 {
   "snappish1": {
-    "snapshot_id": "aws-beta#8808",
+    "snapshot_id": "aws-beta#8810",
     "artifacts": [
       {
         "fingerprint": "8446d65644ec150a1951d54b6d98d3b16f9601b3286453f9b71e9bc0f51a36db",
@@ -79,7 +79,7 @@ kosli diff snapshots aws-beta aws-prod --output=json
     ]
   },
   "snappish2": {
-    "snapshot_id": "aws-prod#5541",
+    "snapshot_id": "aws-prod#5544",
     "artifacts": [
       {
         "fingerprint": "e16d7a10b27f5946e0c4ab8914f0b9e421b626854592692c5db5592eaebc7203",

client_reference/kosli_get_api-key.md

@@ -1,6 +1,6 @@
 ---
 title: "kosli get api-key"
-description: "Get an API key's metadata for a service account."
+description: "Get an API key's metadata for a service account, or one of your own personal API keys."
 ---
 
 ## Synopsis
@@ -9,7 +9,7 @@ description: "Get an API key's metadata for a service account."
 kosli get api-key KEY-ID [flags]
 ```
 
-Get an API key's metadata for a service account.
+Get an API key's metadata for a service account, or one of your own personal API keys.
 
 Only the metadata of the API key is returned; the key value itself is never
 returned (it is only shown once, at creation or rotation time).
@@ -19,7 +19,8 @@ returned (it is only shown once, at creation or rotation time).
 | :--- | :--- | :--- |
 | `-h`, `--help` | bool | help for api-key |
 | `-o`, `--output` | string | [defaulted] The format of the output. Valid formats are: [table, json]. (default "table") |
-| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. |
+| `--personal` | bool | Manage your own personal API keys instead of a service account's. `--org` is not needed. Either this or `--service-account` is required. |
+| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. Either this or `--personal` is required. |
 
 
 ## Flags inherited from parent commands
@@ -44,6 +45,13 @@ These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and
 ```shell
 kosli get api-key yourApiKeyID 
 	--service-account yourServiceAccountName 
+
+```
+</Accordion>
+<Accordion title="get the metadata of one of your own personal API keys">
+```shell
+kosli get api-key yourApiKeyID 
+	--personal 
 ```
 </Accordion>
 </AccordionGroup>

client_reference/kosli_get_environment.md

@@ -50,9 +50,9 @@ kosli get environment aws-prod --output=json
   "name": "aws-prod",
   "type": "ECS",
   "description": "The ECS cluster for production cyber-dojo",
-  "last_modified_at": 1793215378.8179483,
-  "last_reported_at": 1793215378.8179483,
-  "last_changed_at": 1793179798.4294283,
+  "last_modified_at": 1793274898.4478223,
+  "last_reported_at": 1793274898.4478223,
+  "last_changed_at": 1793259778.583906,
   "state": true,
   "include_scaling": false,
   "tags": {