vault config

Manage Vault configuration as code. Pull components, Vault Java SDK classes, and Custom Pages to a local workspace. Edit them, preview and push changes back to Vault.

The vault config subcommands are pull, push, and package. All accept --dir <DIR> to set the workspace root (default: current directory).

---

vault config pull

Section link for vault config pull

Pull components, Vault Java SDK classes, and Custom Pages from a Vault to the local workspace.

Only changed files are written. Unchanged files are left untouched. Components are written with large or structured attribute values extracted into typed sidecar files (.xml, .json, .txt, .js) for diff-friendly source control.

Usage

Section link for Usage

Copy to clipboard

vault config pull [--dns <DNS>] [--dir <DIR>] [--type <TYPES>...] [--translations] [--dry-run]

Options

Section link for Options

Option	Type	Required	Description
--dns <DNS>	string	Optional	Vault DNS to pull from (default: the active vault)
--dir <DIR>	string	Optional	Workspace root. Default: current directory
--type <TYPES>...	string	Optional	Limit to specific component types (repeatable). For example, --type Picklist --type ObjectType
--translations	flag	Optional	Also pull bulk translation CSVs
--dry-run	flag	Optional	Report what would change without writing to disk

This command also accepts the global options.

Examples

Section link for Examples

Pull all configuration

Section link for Pull all configuration

Copy to clipboard

vault config pull

Preview without writing

Section link for Preview without writing

Copy to clipboard

vault config pull --dry-run

---

vault config push

Section link for vault config push

Deploy local workspace changes to a Vault.

Computes the diff from local files, reassembles sidecar files into full MDL, and deploys only what changed. Runs a drift pre-check before deploying. Stops if the remote vault has been modified since your last pull.

Caution

--allow-deletes permits the CLI to delete components from the Vault that are no longer present in your local workspace. Always review the dry-run output before using this flag.

Usage

Section link for Usage

Copy to clipboard

vault config push [--dns <DNS>] [--dir <DIR>] [--dry-run] [--allow-deletes]

Options

Section link for Options

Option	Type	Required	Description
--dns <DNS>	string	Optional	Vault DNS to push to (default: the active vault)
--dir <DIR>	string	Optional	Workspace root. Default: current directory
--dry-run	flag	Optional	Print the push plan without deploying. Shows an unvalidated diff of what would change.
--allow-deletes	flag	Optional	Permit component deletions from the Vault

This command also accepts the global options.

Examples

Section link for Examples

Push changed files

Section link for Push changed files

Copy to clipboard

vault config push

Preview the deploy plan

Section link for Preview the deploy plan

Copy to clipboard

vault config push --dry-run

CI/CD (non-interactive)

Section link for CI/CD (non-interactive)

Copy to clipboard

vault config push --yes

---

vault config package create

Section link for vault config package create

Build a VPK package from locally changed components.

Only MDL components are included. Vault Java SDK classes and Custom Pages are not packaged.

Usage

Section link for Usage

Copy to clipboard

vault config package create [--dns <DNS>] [--dir <DIR>] [--output <FILE>] [--description <TEXT>] [--author <NAME>]

Options

Section link for Options

Option	Type	Required	Description
--dns <DNS>	string	Optional	Vault DNS used to resolve component metadata (default: the active vault)
--dir <DIR>	string	Optional	Workspace root. Default: current directory
--output <FILE>	string	Optional	Output VPK path. Default: <workspace>/package.vpk
--description <TEXT>	string	Optional	Description to embed in the package manifest
--author <NAME>	string	Optional	Author to embed in the manifest. Default: your stored username for the target vault, if any

This command also accepts the global options.

Examples

Section link for Examples

Build a package from changed components

Section link for Build a package from changed components

Copy to clipboard

vault config package create

Build a package to a specific path

Section link for Build a package to a specific path

Copy to clipboard

vault config package create --output ./releases/mypackage.vpk

---

vault config package deploy

Section link for vault config package deploy

Upload and import a VPK package into a Vault.

Runs a two-step import and deploy pipeline: uploads the VPK, polls the import job, then triggers and polls the deploy job.

Caution

This command deploys to the target Vault immediately on success. Use --dry-run to validate the VPK without uploading.

Usage

Section link for Usage

Copy to clipboard

vault config package deploy <VPK> [--dns <DNS>] [--dir <DIR>] [--dry-run]

Options

Section link for Options

Option	Type	Required	Description
<VPK>	string	Required	Path to the VPK archive to deploy
--dns <DNS>	string	Optional	Vault DNS to deploy to (default: the active vault)
--dir <DIR>	string	Optional	Workspace root. Default: current directory
--dry-run	flag	Optional	Validate the VPK without uploading

This command also accepts the global options.

Examples

Section link for Examples

Deploy a VPK to the active environment

Section link for Deploy a VPK to the active environment

Copy to clipboard

vault config package deploy ./releases/mypackage.vpk

Validate without deploying

Section link for Validate without deploying

Copy to clipboard

vault config package deploy ./releases/mypackage.vpk --dry-run

CI/CD (non-interactive)

Section link for CI/CD (non-interactive)

Copy to clipboard

vault config package deploy ./releases/mypackage.vpk --yes