**Source URL:** https://limited.veevavault.dev/commercial/vault-dx/cli/guides/working-with-config

# Managing Vault Configuration

The Vault CLI treats Vault configuration as code. You pull configuration to your local filesystem, edit it, preview the diff, and push changes back to Vault. This workflow is the primary use case for the CLI.

## Pull configuration

Pull all components, Vault Java SDK classes, and Custom Pages from your Vault to the local workspace:

```sh
vault config pull
```

The first pull creates the workspace structure automatically. `components/`, `javasdk/`, `custom_pages/`, and `.vault/` directories are created if they do not already exist.

The CLI pulls only what has changed since the last pull. It does not overwrite unchanged files.

To preview what would be pulled without writing to disk:

```sh
vault config pull --dry-run
```

To pull only specific component types:

```sh
vault config pull --type Picklist --type ObjectType
```

**What gets pulled:**

Components are written to `components/<Type>/<name>/`. Large or structured attribute values are extracted into typed sidecar files alongside the main `.mdl` file. XML attributes become `.xml`, JSON attributes become `.json`, and so on. This keeps each component diffable and partially self-validating in source control.

Vault Java SDK classes are written to `javasdk/com/veeva/vault/custom/...` following standard Java package conventions.

Custom Pages are written to `custom_pages/<distribution_name>/`.

## Push configuration

Deploy your local changes to a Vault:

```sh
vault config push
```

The CLI computes the diff from your local workspace and deploys what changed. Sidecar files are re-assembled into full MDL `RECREATEs`. It runs a drift pre-check before pushing. If the remote vault has been modified since your last pull, the push stops:

```
Remote vault has changed since last pull.
Run `vault config pull` to reconcile, or re-run with --yes.
```

To proceed without reconciling:

```sh
vault config push --yes
```

To allow component deletions (disabled by default):

```sh
vault config push --allow-deletes
```

To preview what would change without deploying:

```sh
vault config push --dry-run
```

`vault config push --dry-run` shows an unvalidated diff of what would change. It does not contact Vault for validation.

## Ignoring configuration

Create a `.vdxignore` file at the workspace root to mark configuration as unmanaged. The CLI will never pull, diff, push, or delete matched files:

```
# .vdxignore
components/Report/**
components/Picklist/supplier__v/
```

The `.vdxignore` format follows the same rules as a `.gitignore` file.

---

**Previous:** [Guides](/commercial/vault-dx/cli/guides)  
**Next:** [Claude Plugins](/commercial/vault-dx/plugins)