Managing Vault Configuration

The Vault CLI treats Vault configuration as code. You pull configuration to your local filesystem, edit it, preview the diff, and push changes back to Vault. This workflow is the primary use case for the CLI.

Pull configuration

Pull all components, Vault Java SDK classes, and Custom Pages from your Vault to the local workspace:

vault config pull

The first pull creates the workspace structure automatically. components/, javasdk/, custom_pages/, and .vault/ directories are created if they do not already exist.

The CLI pulls only what has changed since the last pull. It does not overwrite unchanged files.

To preview what would be pulled without writing to disk:

vault config pull --dry-run

To pull only specific component types:

vault config pull --type Picklist --type ObjectType

What gets pulled:

Components are written to components/<Type>/<name>/. Large or structured attribute values are extracted into typed sidecar files alongside the main .mdl file. XML attributes become .xml, JSON attributes become .json, and so on. This keeps each component diffable and partially self-validating in source control.

Vault Java SDK classes are written to javasdk/com/veeva/vault/custom/... following standard Java package conventions.

Custom Pages are written to custom_pages/<distribution_name>/.

Push configuration

Deploy your local changes to a Vault:

vault config push

The CLI computes the diff from your local workspace and deploys what changed. Sidecar files are re-assembled into full MDL RECREATEs. It runs a drift pre-check before pushing. If the remote vault has been modified since your last pull, the push stops:

Remote vault has changed since last pull.
Run `vault config pull` to reconcile, or re-run with --yes.

To proceed without reconciling:

vault config push --yes

To allow component deletions (disabled by default):

vault config push --allow-deletes

To preview what would change without deploying:

vault config push --dry-run

vault config push --dry-run shows an unvalidated diff of what would change. It does not contact Vault for validation.

Ignoring configuration

Create a .vdxignore file at the workspace root to mark configuration as unmanaged. The CLI will never pull, diff, push, or delete matched files:

# .vdxignore
components/Report/**
components/Picklist/supplier__v/

The .vdxignore format follows the same rules as a .gitignore file.